Steam API Breach Exposes Achievements for Unreleased Games

A technical glitch on Valve backend systems has exposed private achievement lists for hundreds of upcoming and unannounced games on Steam. The data became visible through an unrestricted Steam API endpoint and was automatically scraped by tracking platform Exophase, revealing story details, locations, and gameplay mechanics for major unreleased titles including Kingdom Hearts 4 and Persona 6.

Quick facts

• Incident: unrestricted Steam API endpoint exposed hidden achievement data
• Scope: hundreds of upcoming, unannounced, and potentially canceled titles
• Discovered by: achievement tracking platform Exophase through automated scraping
• Confirmed by: Exophase owner Mike Bendel in a post on ResetEra
• Disney worlds detail: Kingdom Hearts 4 data references unannounced worlds and locations
• Persona 6 detail: 48 achievements reference party mechanics and a Yokohama setting
• Context: second major Valve security failure reported within weeks

Kingdom Hearts 4 and Persona 6 details surface online

The leaked achievement rosters cover some of the most anticipated games in development. The Kingdom Hearts 4 data revealed previously unannounced Disney worlds and narrative locations, giving fans an early and unintended look at where the next chapter of the series may travel. Readers following the series can catch up with our report on the Kingdom Hearts 4 release window for context on how far out the game remains.

The Persona 6 material is even more specific. The leak includes 48 distinct achievements that reference core party mechanics, story beats, and a Yokohama setting, which amounts to a detailed outline of systems and plot points Atlus has yet to announce. For a series built on slow reveals and carefully guarded surprises, the exposure of that much structured detail in one sweep is a serious blow to its marketing plans.

Other affected titles span both announced projects and complete surprises. The lists include Gears of War E-Day, Mega Man Dual Override, and Silent Hill Townfall, alongside unannounced projects ranging from a Twin Peaks adaptation to a collection tied to Telltale Games take on The Walking Dead. The leaked entries also expose gameplay mechanics and setting locations that developers had kept internal, which means the damage goes beyond titles and dates into genuine spoiler territory.

Inside the Steam API failure

According to Exophase owner Mike Bendel, who addressed the incident in a post on the ResetEra forum, the leak happened because Valve accidentally dropped access restrictions on the API endpoint. That change allowed third party tools to scrape hidden AppID entries without the authentication keys that normally keep internal development data private. Scrapers built to track public achievement data kept working as designed, but they suddenly had access to entries that were never meant to be visible.

The mechanism matters because it points to a configuration error rather than an outside intrusion. Nobody broke into Valve servers. The door was left open by mistake, and automated systems walked through it. That distinction offers little comfort to developers whose unannounced projects are now indexed on achievement tracking sites such as Exophase, where achievement names and descriptions can be searched and shared within minutes.

Second Valve security failure within weeks

This breach follows closely on another major Valve data exposure. Weeks earlier, a separate incident surfaced around 13 terabytes of material containing legacy Steam prototypes and beta builds dating from 2003 through 2013. Two large scale failures in such a short span raises legitimate questions about how Valve reviews changes to systems that guard sensitive partner data.

The timing is awkward for a company whose storefront hosts a large share of PC game releases. Developers trust Valve with early builds, internal metadata, and unannounced AppID entries as a routine part of preparing a Steam launch. Each incident chips away at that trust, and studios with unannounced projects now have reason to ask what safeguards stand between their private data and the next misconfigured endpoint.

Long road ahead for affected developers

For the studios named in the leaked lists, the immediate problem is spoiler control. Achievement text often describes late game objectives, hidden characters, and final locations, so fans piecing together the Persona 6 or Kingdom Hearts 4 entries can reconstruct story outlines the publishers intended to reveal over months. Marketing teams may now need to adjust reveal schedules or accept that some surprises have already been spent.

The longer term question is what Valve changes in response. Restoring the API restrictions closes this specific hole, but developers and players will watch for a fuller explanation of how the restrictions were dropped and what review process failed to catch it. Until then, every unannounced Steam AppID carries a little more risk than studios assumed, and the industry has a fresh reminder that even routine backend systems can become the source of the year biggest leaks.

Please note that when you make a purchase through our links at GameHaunt, we might earn a small commission. This helps us keep bringing you the free journalism you love on our site! And don't worry, our editorial content remains totally unbiased. If you'd like to show some support, you can do so here.