In a surprising turn of events, achievement information for several games that have not yet been released—or even officially announced—has surfaced on public tracking sites such as Exophase and SteamDB. Among the titles whose achievement data was unintentionally exposed are high‑profile projects like the upcoming Fable sequel, Persona 6, Kingdom Hearts 4, and the anticipated Control: Resonance expansion. The leak was traced back to a technical mishap on Valve’s side.
Simon Carless, the founder of GameDiscoverCo, explained that Valve inadvertently deployed a "major bug" related to its achievement system during its routine weekly maintenance window. This bug caused the internal achievement database to become temporarily readable by external services that normally scrape Steam’s public API for achievement statistics. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased… or even unannounced," Carless said in a statement. In other words, the bug opened a backdoor that allowed these third‑party aggregators to pull achievement entries for games that are still under development and whose titles have not yet been disclosed to the public.
Mike Bendel, the owner of Exophase, clarified that the situation was not the result of a deliberate data breach but rather a side‑effect of Valve’s error. Responding to a query on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not display games lacking a proper name, but during the incident the system fell back to using the numerical AppID as a placeholder, which made the otherwise hidden entries visible to anyone browsing the site.
The ripple effect of the bug extended beyond the flagship titles mentioned earlier. According to a report from Gematsu, a wide array of other games also had their achievement data unintentionally published.
The list includes: - Gears of War: E‑Day - Clutch - Horizon Hunters Gathering - Ace Combat 8 - Metro 2039 - Star Wars: Galactic Racer - Stranger Than Heaven - Rayman Legends: Retold - Tomb Raider: Legacy of Atlantis These games span multiple genres and development stages, underscoring how the bug impacted the entire Steam catalogue rather than a specific subset. The exposure of achievement data for unreleased titles can be problematic for developers, as it may reveal hints about game content, progression systems, or even confirm the existence of a project that the studio intended to keep under wraps. GamesIndustry.biz reached out to Valve for comment and further clarification.
While Valve has not yet issued a detailed public statement specifically addressing the achievement bug, the company’s history of transparency in other security matters suggests that an official response may follow. It is worth noting that this incident is not Valve’s first encounter with data‑related issues.
In July, the company confirmed that personal information belonging to European customers had been compromised after a breach at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. Valve disclosed that the attack on CEVA occurred between July 29 and August 1, with the breach being discovered on August 7.
That episode highlighted the broader challenges of safeguarding user data across the entire Steam ecosystem, including third‑party vendors. The current achievement leak raises several questions for both developers and players.
For developers, the unintended exposure of achievement milestones could spoil narrative elements or gameplay mechanics that were meant to be surprises. It also forces studios to consider whether to delay the rollout of achievement lists until after a game’s official launch, or to implement additional safeguards within Valve’s API to restrict access to achievement data for titles flagged as "pre‑release" or "private." For players and the broader gaming community, the incident serves as a reminder of how much information is stored behind seemingly innocuous APIs. Achievement trackers are popular tools that provide statistics, leaderboards, and bragging rights, but they rely on the assumption that the data they retrieve is intended for public consumption. When a platform’s internal error makes private data visible, the line between public and confidential blurs.
In response to the leak, both Exophase and SteamDB have taken steps to remove the inadvertently captured entries and to prevent similar occurrences in the future. Bendel indicated that his team is actively cleaning up the affected records and working with Valve to understand the scope of the bug. SteamDB, which aggregates a vast amount of Steam data for analytical purposes, has also issued a brief notice acknowledging the anomaly and promising to tighten its data collection processes.
Valve’s engineering team is reportedly investigating the root cause of the bug. Preliminary speculation suggests that a misconfiguration in the achievement database’s permission settings during the maintenance window allowed the API to return data that should have been flagged as private. Fixing the issue will likely involve a patch to the API’s authentication layer and a review of the maintenance procedures that led to the oversight. The broader industry reaction has been one of cautious optimism.
While any data exposure is undesirable, the swift identification of the problem and the collaborative effort between Valve, the third‑party sites, and the developer community demonstrate a functional response framework. Analysts note that such incidents, though inconvenient, are not uncommon in large‑scale digital platforms where millions of data points are processed daily. Looking ahead, developers may consider implementing additional layers of protection for achievement data, such as encrypting achievement identifiers until a game’s launch or using a separate staging environment for pre‑release content.
Valve could also provide an explicit flag within its developer dashboard that marks achievements as "hidden until release," ensuring that the API respects that setting regardless of maintenance activities. In summary, a maintenance‑related bug on Valve’s side unintentionally opened the door for achievement information from a wide range of unreleased and unannounced Steam titles to be harvested by public trackers. The incident has prompted immediate cleanup actions by Exophase and SteamDB, sparked inquiries from gaming news outlets, and reignited discussions about data privacy and API security within the gaming industry.
As Valve works to resolve the underlying issue, both developers and players are reminded of the delicate balance between transparency, community tools, and the protection of unreleased content.