In a surprising turn of events, achievement data for several games that have not yet been released—or even officially announced—has surfaced on public achievement‑tracking websites such as Exophase and SteamDB. The leak includes high‑profile titles that fans have been eagerly awaiting, among them the next instalments of beloved franchises like Fable, Persona, Kingdom Hearts, and Control. The root cause, according to Simon Carless, the founder of GameDiscoverCo, appears to be a technical fault that Valve inadvertently introduced during its routine weekly maintenance window. Carless explained that Valve "unfortunately rolled out a major bug around achievements" which unintentionally opened the door for automated scrapers to pull data that was supposed to remain hidden until the developers themselves chose to publish it.
"As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced," Carless said in a statement. This means that the achievement structures—lists of trophies, points, and conditions—have been captured for games that are still in early development, or that have not yet been publicly disclosed.
Mike Bendel, the owner of Exophase, clarified that the situation is not a classic data breach but rather an unintended exposure caused by Valve's error. Responding to a query on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not display games without a proper title, but during the brief window when the bug was active, the service logged a number of entries that were identified only by their numeric AppID. "I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)," he noted. The leak extends beyond the headline titles.
According to a report from Gematsu, a wide array of other projects were also affected, including "Gears of War: E-Day," "Clutch," "Horizon Hunters Gathering," "Ace Combat 8," "Metro 2039," "Star Wars: Galactic Racer," "Stranger Than Heaven," "Rayman Legends: Retold," and "Tomb Raider: Legacy of Atlantis." Each of these games now has its achievement framework visible to anyone who queries the public Steam API, providing a rare glimpse into the design intentions of developers still in the planning or prototype stage. GamesIndustry.biz has reached out to Valve for comment and further details, but as of the time of writing the company has not issued an official response beyond acknowledging the technical mishap. The incident follows a separate security incident earlier this year when Valve confirmed that personal data belonging to European customers had been compromised.
That breach was traced back to a compromise of CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware in Europe. The attack on CEVA occurred between July 29 and August 1, with Valve learning of the intrusion on August 7.
The current achievement leak raises several questions for both developers and the broader gaming community. For developers, the premature exposure of achievement structures can reveal design priorities, narrative milestones, or even hint at hidden gameplay mechanics before a title is ready for public consumption.
In some cases, the very existence of an achievement list can confirm that a game is in a more advanced stage of development than the studio has publicly disclosed. From a consumer perspective, the leak fuels speculation and discussion on forums, social media, and fan sites. Players may begin to theorize about the difficulty of upcoming challenges, the potential for secret or optional content, and how these achievements might tie into broader in‑game reward systems. While some fans enjoy the extra layer of mystery, others worry that such information could diminish the surprise factor that developers carefully craft into launch announcements and marketing campaigns.
Technically, the incident underscores the importance of robust access controls on Steam's public API. While the API is designed to be a valuable resource for third‑party services, it must also enforce strict permissions to prevent unintended data exposure. Valve's acknowledgment of a "major bug" suggests that the safeguards around achievement data were either misconfigured or inadvertently disabled during the maintenance patch. Moving forward, Valve will likely need to implement additional validation steps, such as ensuring that only games marked as "released" or "publicly announced" have their achievement metadata exposed to external queries.
The broader industry may also take note of this event as a cautionary tale. As more platforms rely on open APIs to power community tools, leaderboards, and streaming overlays, the balance between openness and security becomes increasingly delicate. Companies may consider adopting tiered API keys, rate limiting, and more granular permission scopes to mitigate the risk of similar leaks.
In summary, a maintenance‑related bug on Valve's side has unintentionally opened the floodgates for achievement data from a host of unreleased and even unannounced games. Services like Exophase and SteamDB have captured and displayed this information, leading to a wave of speculation and concern across the gaming community.
While Valve has not yet provided a detailed remediation plan, the incident highlights the need for tighter API controls and serves as a reminder that even routine updates can have far‑reaching consequences when they intersect with publicly accessible data streams.