Steam API Leak Exposes Persona 6, Kingdom Hearts 4 and 30+ Unannounced Games
In September 2026, a Steam API misconfiguration made achievement data for over 30 unreleased games publicly accessible, where it was scraped and indexed by sites such as Exophase and SteamDB. The exposed list includes Persona 6, Kingdom Hearts IV, and Dragon Ball Xenoverse 3. This article outlines the leaked titles, how the incident unfolded, and its impact.
Event Background
- Wide scope: Over 30 games were exposed, spanning announced and completely unrevealed titles from publishers including SEGA, Square Enix, and Bandai Namco.
- Major spoilers: Achievement lists contain unannounced story details, character information, and location names, with some spoilers being severe.
- Valve's fault: Exophase's owner stated on ResetEra that the leak stems from an issue on Valve's side, with data that should have remained private becoming accessible through Steam's API.
Key Facts
| Item | Detail |
|---|---|
| Leak source | Steam API (Valve-side misconfiguration) |
| Indexer | Exophase / SteamDB |
| Games affected | 30+ |
| Key titles | Persona 6, Kingdom Hearts IV, Dragon Ball Xenoverse 3, and more |
| Spoiler level | High (story, characters, locations) |
How the Incident Unfolded
The incident moved from data exposure to community spread in three stages:
- API misconfiguration: Steam's achievement API was supposed to return public data only for released games, but a configuration error made private achievement lists for unreleased titles accessible.
- Data indexed: Exophase, a cross-platform achievement tracker, automatically scanned Steam's API and catalogued the data; SteamDB also picked up portions.
- Community spread: On September 8, Exophase's owner confirmed the leak's authenticity on ResetEra; Gematsu and other outlets followed with coverage, and the story spread rapidly across X (Twitter), Weibo, and Reddit.
It is worth noting that achievement listings do not equal official announcements—publishers may still adjust or cancel projects, so all leaked information should be treated cautiously until officially confirmed.
Impact and Advice
The Steam API leak is a reminder that platform misconfigurations can lead to large-scale information exposure. For players, managing information intake to avoid spoilers before official releases is key; for developers and platforms, it is a warning about configuration security. Treat official channels as the authoritative source. Practical steps:
- Players anticipating affected titles should avoid visiting achievement pages on Exophase and similar sites directly
- Block keywords on social media (e.g., Persona 6 spoilers, Kingdom Hearts 4 leak)
- Disable notifications from relevant subreddits to avoid spoiler pushes
- Follow ATLUS and Square Enix official channels for accurate information
- Be cautious of videos claiming to show "leaked gameplay"—some are fabricated clickbait
References
Noisy Pixel's detailed report and Gematsu's full analysis provide the most accurate leak lists and media interpretation.