A recent incident has revealed that achievement data for games that have not yet been launched—or even officially announced—has unintentionally become visible on public tracking sites such as Exophase and SteamDB. Titles that were previously kept under wraps, including highly anticipated entries like the next installment of the Fable series, Persona 6, Kingdom Hearts IV, and Control: Resonance, have all had their achievement lists exposed.
The leak was traced back to a bug introduced by Valve during its routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" as part of that maintenance cycle. Because of the flaw, automated crawlers that normally pull achievement data from Steam’s public API began indexing every game that possessed an achievement framework, regardless of whether the title was live, in development, or still under a confidentiality agreement. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased...
or even unannounced," Carless said in a statement. The unintended consequence is that private achievement tables—intended to be hidden until a game’s official release—were harvested and displayed on third‑party sites. Mike Bendel, the owner of Exophase, clarified that the situation was not a deliberate data breach but rather an error on Valve’s side that allowed the API to return information that should have remained inaccessible.
In a response to a user on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not see entries for games without a proper title; however, during the window of the bug, numerous entries appeared with only an AppID placeholder because the game’s name was not yet public. The scope of the leak extends beyond the headline titles. According to a report from Gematsu, other games whose achievement data were inadvertently exposed include Gears of War: E‑Day, Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis. Each of these entries now shows a list of unlockable milestones that developers had intended to keep secret until the respective game’s launch.
GamesIndustry.biz has reached out to Valve for comment and further details about the technical cause and any mitigation steps that are being taken. While Valve has not yet issued a formal public statement specifically addressing the achievement bug, the company’s history of transparency in similar incidents suggests that a patch will be deployed quickly to close the unintended API exposure. It is worth noting that this is not Valve’s first encounter with a security‑related issue affecting user or developer data. In July, the company confirmed that personal information belonging to European customers had been compromised after a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware.
Valve disclosed that the attack on CEVA occurred between July 29 and August 1, and that the company became aware of the intrusion on August 7. That incident prompted Valve to reinforce its data protection protocols and to cooperate with authorities to investigate the breach. The current achievement exposure raises several questions for both developers and players.
For developers, the premature visibility of achievement lists can spoil planned reward structures, hint at game mechanics, or even reveal narrative milestones that were meant to stay hidden until players encounter them in‑game. For players, the leak may diminish the sense of discovery and surprise that achievements often provide, especially for narrative‑driven titles where unlocking a specific trophy can be tied to a story twist. Valve’s API documentation states that achievement data is generally public for released titles, but it also includes provisions for developers to flag achievements as "private" until a certain date.
The bug appears to have overridden those flags, treating all entries as publicly accessible during the brief maintenance window. In response, Valve is expected to issue an update that reinstates the privacy settings and to audit its API endpoints to ensure that similar oversights cannot happen in the future. Community reaction has been mixed.
Some users on forums such as ResetEra and Reddit expressed frustration that confidential information was suddenly searchable, while others pointed out that the data was technically already on Valve’s servers and that the real issue lay in the lack of proper access controls. A few developers have also voiced concerns that the leak could affect marketing plans, as achievement lists often form part of a game’s promotional material and are timed to coincide with launch windows. In the meantime, sites like Exophase and SteamDB have taken steps to remove or hide the newly surfaced entries pending clarification from Valve.
Both platforms have updated their terms of service to reflect that they will not display achievement data for games that are flagged as private by the publisher, and they have pledged to monitor the situation closely. Overall, this episode underscores the delicate balance between openness and confidentiality in modern digital distribution ecosystems. While the ability to query game data through public APIs enables a vibrant community of third‑party services that enhance the Steam experience, it also imposes a responsibility on platform operators to safeguard developer intent and user expectations. As Valve works to rectify the bug and restore confidence, developers and players alike will be watching closely to see how the company addresses the fallout and prevents similar incidents from occurring again.