Steam API leak exposes 50+ unreleased games: achievements surface

Valve’s Steam API seems to have exposed private achievement data for more than 50 unreleased games on September 9, 2026. Third-party trackers Exophase and SteamDB picked it up, and the result was a leak: both sites started surfacing unannounced titles that weren’t supposed to be visible yet.

Steam Download

Exophase owner Mike Bendel described it as a “screw up on Valve’s end,” not a hack. Scans run through Exophase and SteamDB pulled backend entries, sometimes only as AppIDs, that users then connected to Avengers, Dune, Sonic, Sea of Thieves, Twin Peaks, and The Walking Dead.

The entries that appeared on Exophase and SteamDB also seem to have affected games that had already been announced, including Kingdom Hearts IV, Persona 6, Fable, Gears of War: E-Day, Dragon Ball Xenoverse 3, Silent Hill: Townfall, and Squadron 42. Achievement data can give away a lot more than a title card, too: plot beats, locations, mechanics, characters, crossover content, and even Kingdom Hearts worlds nobody had seen before.

If you keep an eye on Steam leaks, this one deserves attention, though some of the names could still be prototypes or working titles. The Avengers connection to a canceled THQ project hasn’t been confirmed, and Balatro creator LocalThunk flatly denied that a supposed sequel or spinoff was real.

Valve hadn’t commented by the time of publication, and most publishers hadn’t either. That leaves some obvious questions hanging, like how long the data was exposed, what changed on the backend, and whether any marketing plans now have to be reworked. Grand Theft Auto 6 didn’t show up, Squadron 42 may be a sign of a Steam release, and the damage here looks tied more to secrecy than to security in the usual sense.