On the night of September 8, 2026, Steam’s public API briefly served achievement lists that were supposed to stay private.
Tracker sites scraped them the same way they scrape any public list.
Exophase owner Mike Bendel (x3sphere) said on ResetEra it looked like a Valve mistake, not a breach: games that should have been locked, including ones with no public name, showed up by AppID.
GameDiscoverCo’s Simon Carless tied it to a bug rolled out around Steam’s weekly maintenance window.
Valve has not commented.
Publishers have not confirmed the lists.
Counts vary by who was tallying.
Gematsu logged about 55 titles.
Dexerto later put the scrape near 85.
Forbes said well over 125 games had achievements posted, mixing released, unreleased, and unannounced.
Many lists were incomplete or full of placeholder text.
Some still named worlds, characters, and story beats.
The names that stuck:
- Persona 6 and Persona 4 Revival. Reports described a Yokohama setting and story-related achievements for Persona 6. None of it is official.
- Kingdom Hearts IV. The list included unannounced worlds. Coverage said that included a Star Wars world, which Square Enix had not shown.
- Fable, Silent Hill: Townfall, Judas, Control Resonant.
- Gears of War: E-Day, Ace Combat 8, Horizon Hunters Gathering, Star Wars: Galactic Racer, Clive Barker’s Hellraiser: Revival. Several of those have since shipped.
- Also named: Dragon Ball Xenoverse 3, Tomb Raider: Legacy of Atlantis, Minecraft Dungeons II, Metro 2039, Mega Man: Dual Override, Stranger Than Heaven, Final Fantasy Resonance, Attack on Titan 3, Deus Ex Remastered, and a handful of titles publishers had not announced.
A separate, much larger Steam incident around the same period dumped prototypes and betas, mostly Valve’s own, reported at about 12 TB.
The achievement scrape is the one people still cite, because it hit third-party unreleased games and put spoiler text on public tracker pages.
Exophase and SteamDB pulled or lost some of the pages within hours.
The text had already been copied.
That is why it is still the backdrop a month later: not a new drop, but the list every newer leak gets measured against.
