A recent incident has revealed that achievement information for games that have not yet been released—or even officially announced—has unintentionally become visible on public achievement tracking sites such as Exophase and SteamDB. Titles that were previously hidden, including highly anticipated entries like the next installment of the Fable series, Persona 6, Kingdom Hearts 4, and the upcoming Control: Resonant, were among those whose achievement data surfaced. The leak was traced back to a bug introduced by Valve during its routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" during this maintenance period.
As a consequence, automated services that scrape Steam's achievement API—most notably Exophase and SteamDB—began pulling data for every game that has an achievement list attached to it, regardless of whether the game is publicly available, still in development, or even officially announced. Mike Bendel, the owner of Exophase, clarified that the situation stems from a mistake on Valve's side rather than a deliberate data breach. In a response to a user on the ResetEra forum, Bendel said, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not encounter entries without a proper game name, but during the brief window when the bug was active, numerous entries appeared with only their numeric AppID displayed because the system could not resolve a title.
The scope of the issue appears to be fairly broad. According to reporting from Gematsu, other titles that were inadvertently listed include Gears of War: E‑Day, Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis. Each of these games had achievement data that should have remained hidden until the developers chose to make the information public, but the bug caused the data to be harvested and displayed on third‑party sites.
GamesIndustry.biz has reached out to Valve for comment and further details about the bug and its impact. While Valve has not yet issued a formal statement specifically addressing this achievement data exposure, the company has a recent history of dealing with security incidents.
In July, Valve confirmed that personal data belonging to European customers had been compromised as a result of a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware. The breach at CEVA occurred between July 29 and August 1, and Valve learned of the intrusion on August 7. The current achievement leak raises several concerns for developers and publishers. Achievement systems are often used as a marketing tool, and early exposure of achievement lists can hint at game mechanics, progression structures, or even story elements before the official reveal.
For titles that are still in secret development, such leaks could potentially spoil planned surprises or give competitors insight into a game's design. From a technical perspective, the incident underscores the importance of robust access controls on public APIs. While Valve's Steam Web API provides a wealth of data for developers and community sites, it also needs safeguards to prevent unintended exposure of sensitive information. In this case, the bug appears to have temporarily lifted a filter that normally restricts achievement data to games that have been marked as public.
Once the filter was inadvertently disabled, any automated scraper could query the API and retrieve the hidden achievement tables. The community reaction has been a mix of curiosity and criticism. Some gamers are excited to see what achievements might be planned for upcoming titles, treating the leak as a peek behind the curtain. Others, particularly developers, view the incident as a breach of trust that could undermine the controlled rollout of game information.
Industry analysts suggest that Valve will likely move quickly to patch the bug and may consider implementing additional verification steps before achievement data is exposed via the API. Looking forward, it is probable that Valve will issue a patch to restore the proper filtering mechanisms and may also reach out to affected developers to apologize for the accidental disclosure. In the meantime, sites like Exophase and SteamDB have likely removed or hidden the newly surfaced entries until the underlying issue is fully resolved. Users of these platforms should remain aware that the data they see is subject to change as Valve addresses the problem.
Overall, the episode serves as a reminder that even well‑established platforms can encounter unexpected glitches that ripple across the broader ecosystem. For developers, it highlights the need to stay vigilant about how their game's metadata is shared and to maintain open lines of communication with platform providers. For players, it offers a cautionary tale about the fleeting nature of secrecy in the digital age, where a brief window of vulnerability can expose details that were meant to stay hidden until the official announcement.