Steam Achievement Data for Unreleased and Unannounced Titles Exposed on Sites Like Exophase and SteamDB

In a surprising turn of events, achievement information for several games that have not yet been released—or even officially announced—has surfaced on public tracking sites such as Exophase and SteamDB. Among the titles whose hidden achievements were inadvertently exposed are highly anticipated entries like *Fable*, *Persona 6*, *Kingdom Hearts 4*, and *Control: Resonant*. The leak has sparked a flurry of discussion across the gaming community, as well as concerns about how such data became publicly accessible. The root cause, according to Simon Carless, the founder of GameDiscoverCo, appears to be a significant bug that Valve inadvertently introduced during its routine weekly maintenance window.

Carless explained that the bug affected the way Valve’s servers handled achievement metadata, causing an unintended spill of information. "Valve unfortunately rolled out a major bug around achievements after its weekly maintenance window," Carless said. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced." Exophase’s owner, Mike Bendel, weighed in on the situation, emphasizing that the issue stems from Valve’s error rather than a malicious data breach.

In a response to a user on the ResetEra forum, Bendel clarified, "A bunch of games with achievements that should be private are accessible through the API right now and that's why they got scanned into the site." He added that his system typically does not display games without a proper title, but during the incident, many entries appeared under their numeric AppID because the official names were not yet known. "I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)," Bendel noted.

The scope of the leak extends beyond the flagship titles mentioned earlier. According to a report from Gematsu, a variety of other upcoming or speculative projects were also affected.

These include *Gears of War: E‑Day*, a new entry in the long‑running shooter franchise; *Clutch*, an indie title that has been generating buzz for its unique gameplay mechanics; *Horizon Hunters Gathering*, a spin‑off from the popular *Horizon* series; *Ace Combat 8*, the next installment in the aerial combat saga; *Metro 2039*, a continuation of the post‑apocalyptic Metro series; *Star Wars: Galactic Racer*, a racing game set in the Star Wars universe; *Stranger Than Heaven*, an upcoming narrative‑driven adventure; *Rayman Legends: Retold*, a refreshed version of the beloved platformer; and *Tomb Raider: Legacy of Atlantis*, a new chapter in Lara Croft’s storied career. While the immediate technical cause appears to be a bug in Valve’s achievement API, the incident has revived broader conversations about data privacy on Steam.

GamesIndustry.biz has reached out to Valve for additional comments and clarification on how the bug occurred, what steps are being taken to remediate the exposure, and whether any user data beyond achievement metadata might have been compromised. This is not the first time Valve has faced scrutiny over data security. In July, the company confirmed that personal information belonging to European customers was compromised in a separate breach involving CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. The attack on CEVA took place between July 29 and August 1, and Valve only became aware of the intrusion on August 7.

That incident highlighted the vulnerabilities that can arise when third‑party services handle sensitive user data, prompting Valve to review and tighten its security protocols. Returning to the current achievement leak, it is worth noting how the Steam ecosystem typically treats achievement data.

Achievements are generally considered a form of optional, non‑essential metadata that enhances player engagement. However, they can also reveal spoilers, narrative beats, or even the existence of a game that developers have chosen to keep under wraps until a formal announcement.

For example, the presence of a hidden achievement titled "First Encounter" for an unreleased title could hint at a pivotal storyline moment, giving observant fans an early glimpse into plot details. The automatic data collection performed by sites like Exophase and SteamDB relies on Valve’s public API, which is designed to provide developers and third‑party services with real‑time information about games, player statistics, and achievements.

Under normal circumstances, this API respects privacy settings and only surfaces data that is meant to be public. The bug, however, appears to have overridden those safeguards, allowing the API to return achievement lists for games that have not yet been officially listed on the Steam store. From a developer’s perspective, the unintended exposure can be problematic for several reasons. First, it undermines marketing strategies that rely on surprise reveals and controlled information releases.

Second, it can lead to misinformation or speculation that distracts from the intended narrative surrounding a game’s launch. Finally, it raises concerns about the integrity of the achievement system itself; if players can see upcoming achievements, they may attempt to game the system or develop unofficial guides before the game is even playable.

Valve’s response, as of now, has been limited to acknowledging the bug and working to patch it. The company has not yet disclosed whether any corrective measures have been taken to remove the leaked data from third‑party sites or whether they have reached out to developers whose titles were affected. Industry observers are watching closely to see if Valve will implement additional safeguards, such as stricter API authentication or a delayed release of achievement data for unreleased titles. In the meantime, community members on forums like ResetEra and Reddit have begun cataloguing the newly visible achievements, sharing screenshots, and speculating about what the hidden data might indicate about upcoming releases.

Some fans view the leak as an inadvertent peek behind the curtain, while others express frustration at the breach of confidentiality. Overall, the incident serves as a reminder of the delicate balance between openness and privacy in digital distribution platforms. While transparency can foster community engagement and allow third‑party services to enhance the player experience, it also requires robust technical safeguards to ensure that only intended information is exposed.

As Valve works to resolve the bug, both developers and players will be hoping for a swift fix that restores confidence in the integrity of Steam’s achievement ecosystem. The situation continues to evolve, and further updates from Valve, affected developers, and data‑tracking sites are expected in the coming days.