Full Breakdown
Massive Steam Achievement Leak Exposes Unreleased Game Details
9/10/2026, 4:05:50 AM
Core Event
On 9 September, achievement-tracking site Exophase began displaying full achievement lists for dozens of upcoming and unannounced PC titles after the data became accessible through Steam’s public API. The leaked entries included high-profile projects such as Persona 6, Kingdom Hearts IV, Fable, Control Resonant, and other announced and speculative games. The exposure revealed achievement descriptions that hint at plot points, locations, characters, and gameplay systems, creating a spoiler risk for fans.
Background & Context
Steam’s achievement system stores metadata for each game on Valve’s backend. Earlier in 2024, Valve confirmed a breach of its European shipping partner CEVA Logistics that compromised customer data between 29 July and 1 August, with the company learning of the incident on 7 August. While unrelated to the achievement issue, the earlier breach highlighted vulnerabilities in Valve’s ecosystem and increased scrutiny of subsequent data exposures.
Timeline
| Date (occurred) | Event |
|---|---|
| 29 July – 1 August | Attack on CEVA Logistics, Valve’s regional shipping partner (data breach). |
| 7 August | Valve learned of the CEVA breach. |
| 9 September | Exophase scanned and published achievement data for numerous unreleased and unannounced games after the Steam API exposed the lists. |
Data & Statistics
- GamingBible reported at least 145 games appearing in the leak.
- TechRadar counted “nearly 90” affected titles.
- Eurogamer noted “more than a dozen” games.
The discrepancy underscores the evolving nature of the leak as additional entries continue to surface.
Official Statements & Responses
- Valve has not issued a public comment on the achievement exposure.
- Mike Bendel, owner of Exophase, attributed the incident to a “possible screw-up on Valve’s end,” explaining that the Steam API unintentionally allowed automated collectors to retrieve achievement data for every game, including those without public names.
Conflicting Reports & Gaps
Sources differ on the total number of games impacted: GamingBible cites 145, TechRadar mentions nearly 90, and Eurogamer references “more than a dozen.” No outlet provides a definitive, verified count, leaving the exact scale uncertain. While several parties attribute the leak to an API error, no technical analysis has been published confirming the precise mechanism, and Valve’s silence leaves the root cause officially unverified.
Verbatim Quotes
- “As a result, automated data collectors of Steam achievement info such as Exophase and SteamDB are collecting achievement data for every single Steam game that has one, even those unreleased... or even unannounced,” — Carless, Exophase
Why It Matters
Achievement descriptions can disclose narrative beats, character introductions, and gameplay mechanics before a publisher is ready to reveal them. For story-driven titles such as Persona 6, Kingdom Hearts IV, and Gears of War: E-Day, early exposure may diminish player anticipation and complicate marketing strategies. The incident also raises concerns about the security of developer-submitted data on digital distribution platforms.
What’s Next
No future actions have been announced by Valve or the affected publishers. Industry observers expect Valve to investigate the API exposure and consider stricter access controls. Publishers may issue statements or legal notices if leaked achievement details conflict with non-disclosure agreements. Until official clarification arrives, the list of affected games is expected to continue expanding.
