In a surprising turn of events, achievement data for several games that have not yet been released—or even officially announced—has surfaced on public tracking sites such as Exophase and SteamDB. The leak includes high‑profile titles like the upcoming entries Fable, Persona 6, Kingdom Hearts 4, and Control: Resonant, among others.
The incident was first highlighted by Simon Carless, the founder of GameDiscoverCo, who explained that Valve inadvertently introduced a substantial bug during its routine weekly maintenance window. Carless said that the flaw caused the Steam achievement system to expose information that is normally kept private until a game launches or is formally announced.
"Unfortunately, Valve rolled out a major bug around achievements after its weekly maintenance window," Carless told reporters. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased… or even unannounced." Mike Bendel, the owner of Exophase, confirmed that the situation stemmed from a Valve error rather than an intentional data breach. In a response to a user on the ResetEra forum, Bendel clarified, "A bunch of games with achievements that should be private are accessible through the API right now and that's why they got scanned into the site." He added that his platform typically never sees entries for games lacking an official title.
"I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)." According to coverage from Gematsu, the list of affected titles extends well beyond the headline names. Other games that appeared with prematurely exposed achievement data include Gears of War: E‑Day, Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis. Each of these entries showed achievement listings on the aggregator sites even though many of them have not been officially confirmed by their developers.
The exposure raises questions about how Steam's public API handles sensitive data. While the API is designed to provide developers and third‑party services with useful information about games, achievements, and player progress, it appears that the recent bug inadvertently broadened the scope of data that could be queried. In normal operation, achievements for unreleased or unannounced titles are flagged as private, preventing them from being displayed publicly. The bug, however, seems to have removed that safeguard, allowing bots that routinely scrape the API to collect and index the data.
GamesIndustry.biz has reached out to Valve for comment and further clarification on the technical cause of the bug, the timeline for a fix, and any steps being taken to protect developers' confidential information. So far, Valve has not issued a formal statement specifically addressing the achievement leak, but the company has a recent history of dealing with security incidents. Earlier this year, in July, Valve confirmed that personal data belonging to European customers had been compromised as a result of a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware. The breach occurred between July 29 and August 1, with Valve learning of the incident on August 7.
That episode highlighted the broader challenges the company faces in safeguarding both user data and the integrity of its platform. The current achievement leak, while less severe than a direct personal‑data breach, still poses risks for developers. Prematurely revealed achievement structures can give competitors insight into a game's progression design, reward systems, and even narrative pacing.
For games that rely on surprise elements or tightly controlled marketing rollouts, having achievement titles and descriptions appear online can diminish the impact of official announcements. Valve's engineering team is expected to prioritize a patch that reinstates the privacy flag for all unreleased and unannounced titles. In the meantime, third‑party aggregators like Exophase and SteamDB have taken steps to remove or hide the exposed entries, though the data may already have been cached or downloaded by other services. The incident also serves as a reminder to developers to regularly audit the visibility settings of their Steamworks configurations.
By ensuring that achievement metadata is correctly marked as private until the appropriate launch window, studios can mitigate the chance of accidental exposure caused by platform‑level bugs. For players and fans, the leak offers a tantalizing glimpse into upcoming games. Achievement names and descriptions often hint at key story beats, boss fights, or gameplay mechanics. However, until Valve resolves the underlying issue, the community will have to rely on official channels for accurate and complete information about these highly anticipated titles.
In summary, a maintenance‑related bug on Valve's side inadvertently opened a window for data‑scraping bots to harvest achievement information from games that have not yet been publicly announced. The leak was quickly identified by industry observers, and both Valve and the affected third‑party sites are working to contain the fallout. As the situation develops, developers are advised to double‑check their privacy settings, and users can expect a forthcoming fix that will restore the intended confidentiality of unreleased game achievements.