Steam Achievement Data for Unreleased and Unannounced Titles Exposed on Platforms Like Exophase and SteamDB

A recent incident has revealed that achievement information for games that have not yet been launched—or even publicly announced—has become visible on third‑party Steam tracking sites such as Exophase and SteamDB. Titles that were previously hidden, including highly anticipated releases like the next installment of the Fable series, Persona 6, Kingdom Hearts 4, and the upcoming Control: Resonant, were suddenly listed with full achievement details. The leak was traced back to a bug introduced during Valve’s routine weekly maintenance window.

Simon Carless, the founder of GameDiscoverCo, explained that Valve "unfortunately rolled out a major bug around achievements" during this update. Because of the flaw, automated crawlers that normally pull achievement data from Steam’s public API began scanning every game entry that contained an achievement table, regardless of whether the game was live, in development, or still under a NDA. "As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased...

or even unannounced," Carless said in an interview. The unintended consequence is that games which were supposed to keep their achievement structures private until an official reveal are now exposed to the public, providing a rare glimpse into the design intentions of developers still working on those projects. Mike Bendel, the owner of Exophase, clarified that the situation stems from an error on Valve’s side rather than a deliberate data breach. In a response to a user on the ResetEra forum, Bendel wrote, "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added that his platform typically does not display games lacking a proper title; when the API returns an unnamed entry, Exophase substitutes the numeric AppID as a placeholder.

"I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)," he noted. The phenomenon is not limited to the headline titles mentioned earlier. According to Japanese gaming outlet Gematsu, a wide array of other projects were also caught in the sweep. These include "Gears of War: E‑Day," a spin‑off that had been quietly in development; "Clutch," an upcoming indie action game; "Horizon Hunters Gathering," a multiplayer expansion for the Horizon franchise; "Ace Combat 8," the next entry in the long‑running flight‑sim series; "Metro 2039," a sequel to the post‑apocalyptic Metro games; "Star Wars: Galactic Racer," a racing title set in the Star Wars universe; "Stranger Than Heaven," an atmospheric adventure game; "Rayman Legends: Retold," a remake of the beloved platformer; and "Tomb Raider: Legacy of Atlantis," a new chapter in the Lara Croft saga.

GamesIndustry.biz has reached out to Valve for comment and further details about the scope of the issue, the timeline for a fix, and any potential impact on developers who rely on the secrecy of their achievement structures for marketing purposes. While Valve has not yet issued a formal statement regarding this specific bug, the company’s track record with transparency suggests a response may be forthcoming.

This incident arrives not long after Valve disclosed a separate security breach that affected European customers. In July, Valve confirmed that personal data belonging to users in Europe had been compromised due to an intrusion at CEVA Logistics, the regional shipping partner responsible for delivering Steam hardware. The attack on CEVA occurred between July 29 and August 1, and Valve became aware of the breach on August 7.

The company subsequently notified affected users and took steps to secure the compromised systems. Both events highlight the challenges of managing a massive, globally distributed platform like Steam, where millions of users, countless developers, and numerous third‑party services interact through a shared API. When a maintenance operation goes awry, the ripple effects can expose sensitive information that was never meant for public consumption. For developers, the premature exposure of achievement lists can undermine carefully planned marketing strategies, spoil narrative elements, or reveal design choices that were intended to be surprises.

In response to the achievement leak, some developers may choose to temporarily disable or hide achievement data for affected titles until a patch can be applied. Others might embrace the unexpected publicity, using the accidental reveal as an early teaser to generate buzz. However, the consensus among industry observers is that such leaks are generally undesirable, as they erode the control that creators have over the timing and context of their announcements. Valve’s engineering team is reportedly working on a hotfix to close the loophole that allowed the API to serve private achievement data.

Users of Exophase, SteamDB, and similar services can expect the erroneous entries to disappear once the fix propagates and the sites refresh their caches. Meanwhile, the community has taken to social media platforms to share screenshots of the newly exposed achievement trees, sparking speculation about the difficulty levels, hidden objectives, and thematic direction of the unreleased games. The broader lesson for the industry is the importance of robust access controls and thorough testing of any changes that affect public-facing APIs.

Even a seemingly minor bug in a routine maintenance window can have outsized consequences when it interacts with automated data aggregators that scrape information at scale. As Steam continues to dominate the PC gaming distribution market, both Valve and its partner services will likely invest in additional safeguards to prevent similar incidents in the future. For now, gamers and developers alike are watching closely to see how quickly Valve can remediate the issue and whether any further unintended disclosures will emerge as the fix is rolled out.

The situation serves as a reminder that behind the seamless experience of purchasing and playing games on Steam lies a complex technical infrastructure where a single error can momentarily lift the curtain on projects that were meant to stay behind it.