A recent incident has revealed that achievement data for games that have not yet been released—or even officially announced—has become visible on public tracking services such as Exophase and SteamDB. Titles that were previously hidden, including upcoming entries like *Fable*, *Persona 6*, *Kingdom Hearts 4*, and *Control: Resonant*, were among those whose achievement lists were unintentionally exposed. The leak was traced back to a bug that Valve introduced during its routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that the company "unfortunately rolled out a major bug around achievements" during this scheduled downtime.
Because of the flaw, automated crawlers that normally pull achievement data from Steam’s API began indexing every game that had an achievement set, regardless of whether the title was live, still in development, or even publicly announced. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced," Carless said.
In other words, the bug stripped away the privacy barrier that normally keeps achievement details for unreleased titles hidden until the developers choose to reveal them. Mike Bendel, the owner of Exophase, clarified that the situation stemmed from a Valve error rather than a deliberate data breach. In a response to a query on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not display games lacking a proper title; when the API returns an unknown name, Exophase substitutes the numeric AppID as a placeholder.
Over the past hour, however, a noticeable surge of unnamed entries appeared, each accompanied by a full set of achievements. The scope of the issue extends beyond the high‑profile titles initially mentioned. According to reporting from Gematsu, a variety of other games were also affected, including *Gears of War: E‑Day*, *Clutch*, *Horizon Hunters Gathering*, *Ace Combat 8*, *Metro 2039*, *Star Wars: Galactic Racer*, *Stranger Than Heaven*, *Rayman Legends: Retold*, and *Tomb Raider: Legacy of Atlantis*.
Each of these entries now has its achievement list publicly visible, providing a rare glimpse into the design intentions of developers who have not yet announced their projects. GamesIndustry.biz has reached out to Valve for additional comment and clarification, seeking to understand how widespread the bug might be and what steps the company plans to take to remediate the situation. While Valve has not yet issued a formal statement specific to this achievement leak, the incident comes on the heels of a separate security concern that emerged earlier in the year.
In July, Valve disclosed that personal information belonging to European customers had been compromised as a result of a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. The attack on CEVA occurred between July 29 and August 1, and Valve only became aware of the intrusion on August 7. That breach prompted Valve to reinforce its security protocols and to communicate more transparently with affected users. The current achievement exposure, while not a direct theft of personal data, raises important questions about the privacy of development pipelines on the Steam platform.
Achievements are often used by developers as a roadmap for gameplay milestones, and leaking them prematurely can give competitors or the broader community unintended insight into a game’s structure, difficulty curve, or narrative pacing. For fans, the sudden appearance of achievements for an unannounced title can spark speculation, rumors, and misinformation, potentially influencing public perception before a studio is ready to make an official announcement. Valve’s API is a powerful tool that enables third‑party services to aggregate statistics, track player progress, and provide community‑driven leaderboards.
However, this power also comes with responsibility: safeguards must be in place to ensure that only information intended for public consumption is exposed. In this case, the maintenance bug appears to have disabled or bypassed those safeguards, allowing the API to return achievement data that should have remained hidden until a developer explicitly made it available. Moving forward, the industry will be watching how Valve addresses the flaw. Potential remedial actions could include rolling back the faulty update, patching the API to respect privacy flags for unreleased titles, and possibly issuing a public apology to both developers and players affected by the premature exposure.
Developers may also request that Valve temporarily remove or hide achievement data for their upcoming projects until they are ready to share it. For users of sites like Exophase and SteamDB, the incident serves as a reminder that the data they see is only as reliable as the source API.
While these platforms strive to provide accurate and up‑to‑date information, they are ultimately dependent on the integrity of Valve’s backend services. When a glitch occurs, the ripple effect can be felt across the entire ecosystem of Steam‑related tools and communities.
In summary, a maintenance‑related bug on Valve’s side inadvertently opened the floodgates for achievement data from a broad spectrum of games, ranging from well‑known franchises to titles that have yet to be announced. The leak highlights the delicate balance between openness and confidentiality in modern game distribution platforms and underscores the need for robust safeguards when exposing any form of developer‑controlled content to the public.