A Valve maintenance bug exposed achievement data for unreleased and even unannounced Steam games, with aggregators Exophase and SteamDB automatically scanning titles including Fable, Persona 6, Kingdom Hearts 4 and Control Resonant into their public databases.

GameDiscoverCo founder Simon Carless said Valve "unfortunately rolled out a major bug around achievements" following its "weekly maintenance window." The result: automated achievement collectors picked up data for every Steam game that has achievements — regardless of whether it has been announced.

"Automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced," Carless said.

Was this a data breach?

No, according to Exophase owner Mike Bendel, who framed the incident as an error on Valve's side rather than a leak of Valve's own systems.

"A bunch of games with achievements that should be private are accessible through API right now and that's why they got scanned into the site," Bendel wrote in reply to a user on ResetEra.

Bendel also described an unusual pattern in the incoming data. "I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have (when there's an unknown name we just set it to the AppID)," he said.

Which games were exposed?

Beyond the four headline titles — Fable, Persona 6, Kingdom Hearts 4 and Control Resonant — Gematsu reports the scan surfaced achievements for a broader set of unannounced projects:

• Gears of War: E-Day
• Clutch
• Horizon Hunters Gathering
• Ace Combat 8
• Metro 2039
• Star Wars: Galactic Racer
• Stranger Than Heaven
• Rayman Legends: Retold
• Tomb Raider: Legacy of Atlantis

For publishers, the exposure is less about player data and more about marketing control. Achievement lists routinely reveal campaign structure, character names, story beats and feature sets months or years before a studio intends to disclose them.

What changes for developers?

The incident highlights a persistent operational risk in Steam's public-facing API: unannounced projects live on Valve's servers behind visibility flags, and a single configuration error can strip that protection across the entire catalogue. Studios planning reveals around trade show windows or coordinated announcements now have a concrete example of how those plans can collapse through no fault of their own.

GamesIndustry.biz has contacted Valve for further information on the bug and its scope.

Valve's recent security record

This is not Valve's only recent data incident. In July, the company confirmed that European customers' data was compromised following a breach at CEVA Logistics, its regional shipping partner for Steam hardware. Valve told GamesIndustry.biz the attack on CEVA occurred between July 29 and August 1, and that Valve learned of the breach on August 7.

Unlike the CEVA incident, the achievement bug appears to expose product metadata rather than customer information. Still, both events land in the same quarter and add pressure on Valve to tighten the boundaries between public and private data on its platform.

Worth watching: whether Valve comments publicly on the bug, and how quickly it re-privates the affected achievement lists — publishers of the named titles may have reveal plans that this leak has now preempted.