An apparent flaw in Steam's API exposed achievement lists that should have remained private and led Exophase to index hundreds of games still in development. Among the identified titles are Persona 6, Kingdom Hearts IV, and Ace Combat 8, in addition to projects that had not yet been publicly announced.
The problem gained scale after Exophase, a service specialized in tracking game achievements, began receiving an unusual volume of new entries from Steam. According to Mike Bendel, the owner of the platform, games with private achievements became accessible through Valve's API and were automatically captured by the system.
Leak may involve thousands of projects
Exophase added hundreds — possibly thousands — of new entries to its Steam section. Not all of them necessarily correspond to games that will reach the market: some appear only with identification numbers, incomplete lists, or test achievements, which means the set may also include prototypes and canceled projects.
Among the already known games found in the data are Fable, Gears of War: E-Day, Silent Hill: Townfall, Minecraft Dungeons II, Persona 4 Revival, Deus Ex Remastered, and Tomb Raider: Legacy of Atlantis. A list compiled by Gematsu identified dozens of titles with accessible achievement pages.
The leak also revealed references to projects not yet announced, including possible new games linked to Tetris, Nickelodeon, and The Walking Dead. There is also an entry containing a reference to Twin Peaks, but the available data does not allow determining whether it corresponds to a game in development or a project that has already been abandoned.
Achievements reveal details before official announcements
The impact goes beyond the early disclosure of names. Some lists contain information about characters, locations, and parts of the story. The achievements of Kingdom Hearts IV, for example, indicate worlds that had not yet been officially presented, while those of Persona 6 include never-before-seen details about the game.
So far, there is no indication that the data was obtained through an intrusion. The explanation presented by Exophase's owner points to a change or access error in Steam's API that made public information that should have remained restricted. Valve had not released an official explanation about the incident as of the publication of this article.
