In a surprising turn of events, achievement data for several Steam titles that have not yet been released—or in some cases, have not even been officially announced—has found its way onto public aggregator sites such as Exophase and SteamDB. The leak includes high‑profile projects like the upcoming entries in the Fable series, Persona 6, Kingdom Hearts 4, and the upcoming Control: Resonant expansion, among many others.
The issue was first highlighted by Simon Carless, the founder of GameDiscoverCo, who explained that Valve inadvertently introduced a significant bug during its routine weekly maintenance window. Carless described the situation as a "major bug around achievements" that caused the platform's internal systems to expose achievement metadata that is normally kept private until a game’s official launch or announcement. "Because of that bug, automated data‑gathering services that track Steam achievement information—most notably Exophase and SteamDB—ended up pulling achievement records for every Steam title that has any achievement data attached," Carless told reporters.
"That includes games that are still in early development, games that have never been publicly announced, and even titles that exist only as internal placeholders in Valve’s database." Mike Bendel, the owner of Exophase, weighed in on the matter, emphasizing that the problem stemmed from Valve’s error rather than a malicious data breach. In a response to a user inquiry on the ResetEra forums, Bendel clarified, "A bunch of games with achievements that should be private are accessible through the API right now, and that’s why they got scanned into the site." He added that his platform typically never sees entries with vague or placeholder names showing up with achievement data.
"Usually I never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)." This indicates that the aggregator’s systems were forced to display raw AppID numbers for titles that lacked a public-facing title, further confirming that the data was being harvested directly from Valve’s internal achievement API. The leak has been corroborated by several gaming news outlets. Gematsu compiled a list of additional titles that appear to have been affected, including: - Gears of War: E‑Day - Clutch - Horizon Hunters Gathering - Ace Combat 8 - Metro 2039 - Star Wars: Galactic Racer - Stranger Than Heaven - Rayman Legends: Retold - Tomb Raider: Legacy of Atlantis These titles span a wide range of genres and development stages, from fully announced sequels to speculative projects that have only been hinted at in internal build numbers. The presence of achievement data for such a diverse set of games suggests that the bug impacted Valve’s achievement database globally, rather than being isolated to a specific subset of games.
GamesIndustry.biz has reached out to Valve for an official comment and further clarification on how the bug occurred, what steps are being taken to remediate it, and whether any additional data beyond achievements may have been inadvertently exposed. While Valve has not yet issued a detailed public statement on this particular incident, the company’s history of transparency regarding security incidents provides some context. Earlier this year, Valve confirmed a separate security incident that affected European customers.
In July, the company disclosed that personal data of European users was compromised as a result of a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware such as the Steam Deck and Valve Index. The breach at CEVA occurred between July 29 and August 1, and Valve became aware of the intrusion on August 7. That incident prompted Valve to issue recommendations to affected users and to tighten its data‑handling procedures with third‑party partners.
The current achievement leak, while not a direct exposure of personal user information, raises similar concerns about the integrity of Valve’s data pipelines and the safeguards in place to protect unpublished content. Achievements are often tied to specific milestones within a game’s development, and their premature disclosure can reveal design intentions, narrative beats, or gameplay mechanics that developers prefer to keep under wraps until an official announcement.
Industry analysts note that the inadvertent exposure of achievement data can have broader implications for marketing and hype cycles. For instance, the appearance of an achievement titled "Defeat the Final Boss" for a yet‑unannounced title could spark speculation among fans, leading to rumors that may pressure developers to adjust their release strategies. Moreover, the presence of achievement data for games like "Control Resonant" suggests that Valve’s internal build pipelines were already populating achievement metadata well before the public was aware of the expansion’s existence. Valve’s engineering team is reportedly working around the clock to patch the bug and to revoke the publicly accessible API endpoints that allowed third‑party sites to scrape the data.
In the meantime, aggregators such as Exophase and SteamDB have temporarily removed the questionable entries from their public listings, pending further verification from Valve. For gamers and developers alike, this incident serves as a reminder of the delicate balance between openness and confidentiality in modern digital distribution platforms. While the ability to query achievement data through an API enables vibrant community tools and leaderboards, it also creates a potential vector for accidental leaks when internal safeguards fail. As the situation develops, stakeholders are advised to monitor official communications from Valve for updates on the remediation timeline and any potential impact on other data categories.
In the meantime, the gaming community continues to discuss the ramifications of the leak, with many expressing both excitement over the glimpse of upcoming titles and concern over the security of development pipelines. Overall, the episode underscores the importance of rigorous testing and validation of maintenance updates, especially when they touch on systems that expose data to the public internet. Valve’s swift acknowledgment of the bug and its cooperation with third‑party aggregators suggest a commitment to fixing the issue, but the incident will likely remain a point of discussion in the industry for weeks to come as more details emerge.