Steam achievement data for a slate of unannounced and unreleased games spilled into public view this week after Valve introduced a major API bug during its routine weekly maintenance window. The error allowed automated data collectors to scrape achievement lists for titles that have not been formally revealed, effectively confirming their existence and some developmental progress before publishers were ready to announce them. For players who track upcoming releases through aggregator sites, the leak offers an unexpected but concrete glimpse at projects like Fable, Persona 6, and Kingdom Hearts 4 that have lingered in rumor mills for years.
The significance extends beyond a simple list of names. Achievement structures often reveal core gameplay loops, progression systems, and narrative beats that developers intend to keep under wraps until a marketing rollout. When that data surfaces prematurely, it forces publishers into reactive communication and can disrupt carefully planned reveal cadences. The bug also raises questions about Valve's internal testing procedures for API changes that touch sensitive partner data, especially so soon after a separate security incident involving a logistics partner.
What Was Leaked
According to GameDiscoverCo founder Simon Carless, Valve "unfortunately rolled out a major bug around achievements" after its "weekly maintenance window." The flaw made achievement data accessible via the public API for every Steam game that has achievements configured, regardless of visibility settings. "So automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced," said Carless.
Exophase owner Mike Bendel confirmed the mechanism on ResetEra, stating "a bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site." He added, "I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)." The affected titles identified so far include Fable, Persona 6, Kingdom Hearts 4, Control Resonant, Gears of War: E-Day, Clutch, Horizon Hunters Gathering, Ace Combat 8, Metro 2039, Star Wars: Galactic Racer, Stranger Than Heaven, Rayman Legends: Retold, and Tomb Raider: Legacy of Atlantis.
What It Could Mean
The presence of achievement data on Steam typically indicates a game has reached a stage where platform integration is underway, which often correlates with a launch window within the next 12 to 18 months. For long-rumored projects like Persona 6 and Kingdom Hearts 4, the leak functions as de facto confirmation that development is active and far enough along for Steam backend work. But achievement lists alone do not guarantee imminent announcements; publishers may still hold reveals for major showcases or fiscal quarters.
Some listed titles, such as Rayman Legends: Retold and Tomb Raider: Legacy of Atlantis, have not appeared in credible rumors previously, suggesting the leak may surface projects still in early planning or codenamed prototypes. The inclusion of "Control Resonant" rather than a numbered sequel hints at a potential expansion or spin-off for Remedy's franchise. Until publishers comment, the exact nature of each project remains speculative, but the breadth of the list — spanning Xbox Game Studios, Square Enix, Sega, Bandai Namco, and Ubisoft — indicates the API error was indiscriminate and widespread.
History and Context
This is not Valve's first data-related incident in recent months. In July, the company confirmed that European customers' data was compromised following a breach at CEVA Logistics, Valve's regional shipping partner for Steam hardware. Valve told GamesIndustry.biz the attack on CEVA occurred between July 29 and August 1, and that it learned of the breach on August 7. That incident involved personal shipping information, whereas the current API bug exposes proprietary game metadata — different in severity but similar in root cause: a failure in Valve's operational oversight of partner-facing systems.
Exophase and SteamDB operate as automated aggregators that continuously poll Steam's public APIs; they are not malicious actors but their scrapers function exactly as designed when Valve's access controls fail. Bendel emphasized this was "an error by Valve, not a data leak" on the part of his site. Valve has not yet issued a public statement on the achievement API bug, though GamesIndustry.biz has contacted the company The speed with which Valve revokes the exposed data and audits the maintenance deployment process will determine whether this remains a one-off embarrassment or signals a pattern of platform instability.
For now, the achievement data remains visible on aggregator pages, though some entries may be reverted to AppID placeholders as publishers request takedowns. Players watching for official announcements should treat the list as a strong signal of active development rather than a release schedule. The next major showcase season — typically late summer through early fall — would be the logical venue for publishers to address these titles on their own terms.
