In a surprising turn of events, achievement data for several games that have not yet been released—or even officially announced—has surfaced on public tracking sites such as Exophase and SteamDB. The leak includes high‑profile titles like the upcoming entries Fable, Persona 6, Kingdom Hearts 4, and Control: Resonant, among many others.
The source of the breach appears to be a technical fault on Valve’s side. Simon Carless, the founder of GameDiscoverCo, explained that Valve inadvertently introduced a significant bug during its routine weekly maintenance window. This bug caused the Steam API to expose achievement metadata for every game that possesses an achievement system, regardless of whether the title is publicly visible, still in development, or merely a placeholder in Valve’s internal catalog.
Carless elaborated, “Because of the bug, automated data‑gathering services like Exophase and SteamDB started pulling achievement data for every single Steam game that has an achievement list attached to it. That includes games that haven’t been announced to the public, and even those that are still in the early stages of development.” Mike Bendel, the owner of Exophase, clarified that the situation is not the result of a deliberate data‑theft operation but rather an unintended side effect of Valve’s error. In a response to a query on the ResetEra forum, Bendel said, “A number of games with achievements that should remain private are currently accessible via the Steam API, which is why they were automatically scanned and displayed on our site.” He added that normally Exophase does not display entries lacking a proper game name; however, when the API returns an unnamed entry, the site defaults to showing the numeric AppID.
“In the last hour or so, I’ve seen a flood of these unnamed entries appear, which is unusual,” Bendel noted. The leak is not limited to the four marquee titles mentioned earlier.
According to Japanese gaming outlet Gematsu, the affected list also comprises a diverse set of projects: Gears of War: E‑Day, Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis. Each of these games now has its achievement structure publicly viewable, providing a rare glimpse into the design intentions of developers who have yet to reveal their projects to the broader gaming community. GamesIndustry.biz has reached out to Valve for comment and further clarification, but as of the time of writing, Valve has not issued a formal statement specifically addressing the achievement data exposure.
The company does have a recent history of dealing with security incidents. In July, Valve confirmed that personal information belonging to European customers was compromised after a breach at CEVA Logistics, the regional shipping partner responsible for distributing Steam hardware. The breach at CEVA occurred between July 29 and August 1, with Valve learning of the intrusion on August 7. That incident underscored the challenges large platforms face in safeguarding both user data and internal development pipelines.
The current achievement leak raises several questions for developers, publishers, and the gaming community at large. Achievements are often used as a form of player engagement, rewarding specific milestones, challenges, or hidden secrets within a game.
For unreleased titles, these achievement lists can hint at core gameplay loops, narrative beats, or even secret content that developers intend to keep under wraps until an official reveal. Consequently, the premature exposure of such data could potentially spoil marketing plans, disrupt narrative surprises, or give competitors unintended insight into a game’s design. From a technical standpoint, the incident highlights the fragility of API permissions and the importance of rigorous testing before rolling out updates to production environments.
Valve’s weekly maintenance windows are intended to improve stability and introduce new features, yet a single oversight can cascade into a public disclosure of sensitive information. The episode serves as a reminder to other platform operators that any change to data‑exposure endpoints must be meticulously vetted, especially when dealing with content that is not yet public.
For players and fans, the leak is a mixed blessing. On one hand, it fuels speculation and excitement about upcoming releases, offering a rare peek behind the curtain.
On the other hand, it may diminish the surprise factor that developers carefully craft into their announcements and launch strategies. Community sites like Exophase and SteamDB will likely see a surge in traffic as users scour the newly listed achievements for clues about gameplay mechanics, story elements, or hidden easter eggs. In summary, a maintenance‑related bug on Valve’s side inadvertently opened the Steam achievement API to automated crawlers, resulting in the public listing of achievement data for a wide array of unreleased and unannounced games.
While Valve has yet to comment directly on this particular issue, the incident underscores the broader challenges of data security and privacy within large gaming ecosystems. It also illustrates how a seemingly minor technical glitch can have far‑reaching implications for developers, publishers, and the gaming community, prompting a reevaluation of how achievement data is protected until a title is officially launched.