A recent incident has resulted in the accidental exposure of achievement data for several games that have not yet been released or even officially announced on Steam. Titles such as the upcoming *Fable* sequel, *Persona 6*, *Kingdom Hearts 4*, and *Control: Resonant* were among the games whose achievement lists appeared on third‑party tracking sites.
The problem appears to stem from a bug introduced during Valve’s routine weekly maintenance window. Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" after the maintenance period. Because of this flaw, automated services that scrape Steam’s achievement API—most notably Exophase and SteamDB—ended up pulling data for every game that has an achievement structure attached to it, regardless of whether the title is already on the market or even publicly disclosed.
Mike Bendel, the owner of Exophase, clarified that the situation is not the result of a deliberate data leak but rather a technical error on Valve’s side. In a response to a user on the ResetEra forum, Bendel said, "A bunch of games with achievements that should be private are accessible through the API right now and that's why they got scanned into the site." He added that normally he never sees entries for games without a proper name; however, in the past hour or so the system began listing a series of anonymous entries, which the site simply labels with the corresponding Steam AppID.
The leak has affected a surprisingly wide array of upcoming projects. According to coverage from Gematsu, the following titles were also caught in the sweep: *Gears of War: E‑Day*, *Clutch*, *Horizon Hunters Gathering*, *Ace Combat 8*, *Metro 2039*, *Star Wars: Galactic Racer*, *Stranger Than Heaven*, *Rayman Legends: Retold*, and *Tomb Raider: Legacy of Atlantis*.
Many of these games are still in early development stages, and their achievement structures were presumably being prepared well in advance of any public marketing. GamesIndustry.biz has reached out to Valve for comment and further clarification, but as of now the company has not issued a detailed public statement addressing the specific bug.
The incident does, however, revive memories of a previous security issue that Valve experienced earlier this year. In July, Valve confirmed that the personal data of European customers had been compromised after a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware.
The attack on CEVA took place between July 29 and August 1, and Valve only became aware of the intrusion on August 7, according to the same GamesIndustry.biz report. While the two incidents are unrelated—one involving a data breach at a logistics provider and the other a software glitch affecting achievement visibility—they both highlight the challenges of maintaining privacy and security across the extensive ecosystem that supports Steam.
For developers, the accidental exposure of achievement lists can be problematic. Achievements are often used as a marketing tool, with designers carefully crafting them to align with narrative reveals, gameplay milestones, or thematic elements that are meant to stay under wraps until an official announcement. When these details become visible prematurely, it can spoil planned surprises or give competitors insight into a game's design direction. From the perspective of the aggregator sites, the incident underscores the reliance on Steam’s public API.
Although the API is intended to provide transparent access to game data for legitimate purposes—such as tracking player progress and showcasing leaderboards—its design assumes that the underlying data is meant to be public. When Valve unintentionally exposed private achievement metadata, the scrapers dutifully collected and displayed it, following their standard operating procedures. Valve’s engineering team will likely need to issue a hotfix to close the loophole that allowed private achievement data to be queried.
In the meantime, developers may want to audit their upcoming titles to ensure that any achievement information that should remain confidential is either removed or properly flagged until the games are officially announced. Some studios might also consider implementing additional safeguards, such as delaying the creation of achievement entries in Steam’s backend until closer to a public reveal, thereby reducing the risk of accidental exposure. For the broader gaming community, the incident serves as a reminder that even seemingly innocuous data—like a list of in‑game trophies—can carry significant strategic value. Players who monitor aggregator sites often use achievement information to gauge a game’s difficulty, depth, or even to speculate about hidden content.
When unreleased titles appear in these databases, it fuels speculation and can create a ripple of misinformation if the data is misinterpreted. Overall, the leak of achievement data for unreleased and unannounced games appears to be an unintended side effect of a maintenance‑related bug rather than a malicious hack. Valve’s prompt acknowledgment of the issue, combined with a swift technical remedy, will be essential to restore confidence among developers and users alike. As the situation develops, both the company and the affected studios will likely keep a close eye on how the exposed information is used and work to mitigate any potential fallout from the premature disclosure of their upcoming projects.