Steam API Leak Reveals Kingdom Hearts 4 Worlds, Persona 6 Details, 100+ Unreleased Games [2026]

September 9, 2026. A massive Steam API leak exposed private achievement data for hundreds of unreleased games, including Kingdom Hearts 4, Persona 6, Fable, and many more. Achievement tracking site Exophase indexed the data after a Valve API misconfiguration made private achievement lists publicly accessible for several hours. This marks the second major Valve security incident in two weeks, following a 12TB data leak from Steam's 2003-2013 archives in late August 2026. The leak revealed full achievement lists, world names, and gameplay details for titles that have not yet been officially shown.

Photo: Pexels free use.

Table of Contents

• What Happened With the Steam API Leak
• Full List of Major Games Affected
• How Exophase Indexed the Data
• Kingdom Hearts 4 Leaked Worlds and Achievements
• Persona 6 Details Revealed
• Unannounced and Cancelled Games Found
• Valve's Second Security Incident in Two Weeks
• Complete Games Comparison Table
• Frequently Asked Questions
• Sources and Attribution

What Happened With the Steam API Leak

On September 8, 2026, Steam's public API began returning achievement data for games that should have been private. Achievement tracking services that automatically scan the Steam API picked up hundreds of new entries. These entries included full achievement lists for unreleased titles from major publishers like Square Enix, Atlus, Konami, Capcom, and SEGA.

The API misconfiguration did not require any hacking or unauthorized access. The data was publicly available through legitimate API endpoints that Valve normally restricts to released or announced titles. Third-party services that monitor the Steam API for new achievement data discovered the issue when they began indexing games they had never seen before.

According to Exophase owner Mike Bendel (x3sphere), who posted on ResetEra: "Seems like a possible screw up on Valve's end, a bunch of games with achievements that should be private are accessible through the API right now." He added: "I usually never see games without an actual name pop up with achievements, yet over the past hour or so a bunch have."

The leak lasted for several hours before Valve addressed the issue. By that time, multiple gaming outlets had already documented the achievement data and begun publishing stories about the affected games.

Full List of Major Games Affected

The leak affected titles across every major platform and genre. Some of the biggest names in gaming had their private achievement data exposed. The following titles were confirmed through multiple outlets including VGC, Noisy Pixel, RPG Site, Press Start, NintendoEverything, GamesRadar, Gematsu, and Game Rant.

Kingdom Hearts 4 from Square Enix topped the list, with full achievement data revealing world names and trophy descriptions. Persona 6 from Atlus was also exposed, including its setting and group name. Other major titles included Fable from Playground Games, Gears of War: E-Day from The Coalition, Silent Hill: Townfall from Konami, and Tomb Raider: Legacy of Atlantis from Crystal Dynamics.

The leak also affected titles from Capcom (Mega Man: Dual Override), SEGA (Crazy Taxi: World Tour), Bandai Namco (Ace Combat 8), 4A Games (Metro 2039), and Nihon Falcom (Trails in the Sky 2nd Chapter). Several Xbox first-party titles were included, as were games from Nintendo's publishing partners.

Chris Scullion at VGC reported on September 9 that the scope of the leak extended beyond major releases. Hundreds of smaller titles and indie games were also affected, many identified only by their Steam App ID numbers without official names attached.

How Exophase Indexed the Data

Exophase is an achievement and trophy tracking platform that monitors Steam, PlayStation, Xbox, and other gaming services. The site automatically scans for new achievement data through public API endpoints. When the misconfiguration occurred, Exophase's systems began indexing the new data like they would for any other API update.

Mike Bendel confirmed on ResetEra that the indexing was automatic. The site did not seek out private data or use any unauthorized methods. The achievement data appeared through the same API endpoints that Exophase normally monitors for released games. The difference was that Valve's system was returning data for games that should have been hidden.

The indexing process flagged games without official names, which is what caught Bendel's attention. In normal circumstances, games only appear in the API when they are publicly announced or released. The sudden appearance of unnamed or unannounced titles indicated something had gone wrong on Valve's end.

Exophase did not publish full achievement lists for most of the affected games. The site's standard practice is to track achievements for released titles only. However, the data was visible through the API long enough for others to capture and share it across gaming forums and social media.

Kingdom Hearts 4 Leaked Worlds and Achievements

Kingdom Hearts 4 received the most attention from the leak. Achievement data confirmed multiple worlds, several of which had not been officially announced by Square Enix. Press Start's Shannon Grixti, NintendoEverything's Brian, and RPG Site's Mikhail Madnani all reported on the Kingdom Hearts 4 findings on September 9.

The leaked achievement data confirmed the following worlds for Kingdom Hearts 4:

• Galaxy Far, Far Away (Star Wars) - Achievement "Desert Do-Gooder" and "May the Light Be with You" confirmed a Star Wars world
• Coco - Previously announced, now confirmed through achievement data
• Toy Box (Toy Story) - Return of the Toy Story world from Kingdom Hearts 3
• Haunted Mansion - Disney Parks attraction-based world
• Monochrome Origins - Possibly Oswald the Lucky Rabbit related
• Zootopia (Savanna Central) - Based on the Disney animated film
• Underworld (Hercules) - Return of the Hercules setting from earlier games
• Imagineer Planet - Disney World theme park-inspired world
• Hundred Acre Woods - Winnie the Pooh setting from classic Kingdom Hearts games
• Scala Ad Caelum - Kingdom Hearts 3 ending location
• Quadratum - Real-world setting introduced in Kingdom Hearts 3

The Star World achievement "May the Light Be with You" was the most widely shared detail from the leak. It confirmed long-standing rumors about Star Wars appearing in Kingdom Hearts 4. The achievement title references the franchise's iconic "May the Force be with you" phrase, adapted to fit Kingdom Hearts' light and darkness theme.

NintendoEverything reported that Kingdom Hearts 4 launches on Nintendo Switch 2 in 2027. This marks the first time a mainline Kingdom Hearts title launches simultaneously on a Nintendo platform. The achievement data included platform-specific trophies, confirming the Switch 2 version.

GamesRadar's Anna Koselke noted that the achievement counts for Kingdom Hearts 4 were significantly higher than previous entries. This suggests a larger game with more content than Kingdom Hearts 3, which itself was the longest mainline entry in the series.

Persona 6 Details Revealed

Persona 6 from Atlus was another major title affected by the leak. Achievement data revealed the game's setting, main group name, and several gameplay details before any gameplay footage had been shown publicly. Noisy Pixel's Azario Lopez and RPG Site's Mikhail Madnani both reported on the Persona 6 findings.

According to the leaked achievement data, Persona 6 is set in Yokohama, Japan. The main character's group is called "Hex." Achievement names referenced social links, dungeon exploration, and the calendar system that defines the Persona series.

No release date or platform was confirmed through the achievement data. Atlus has not officially announced Persona 6 as of September 9, 2026. The achievement data appeared before any official reveal, making this the first public look at Persona 6's core details.

The "Hex" group name suggests a six-member party, consistent with the number in the title. Achievement descriptions referenced personality types and social dynamics between party members. This aligns with the series' focus on character relationships and personal growth themes.

RPG Site's Mikhail Madnani noted that the achievement structure for Persona 6 follows the pattern established by Persona 5. Calendar-based progression, social link achievements, and combat-related trophies were all present in the leaked data. The setting of Yokohama represents a shift from Persona 5's Tokyo-based story.

Unannounced and Cancelled Games Found

Beyond the major announced titles, the leak exposed data for numerous unannounced and potentially cancelled games. Chris Scullion at VGC and Drew Swanson at Game Rant both documented these findings on September 9.

Among the most notable discoveries:

• Professor Layton vs Phoenix Wright port - A potential re-release of the 3DS crossover title for modern platforms
• Animal Crossing-style Nickelodeon game - An unannounced life simulation game featuring Nickelodeon properties
• New Tetris game - Achievement data for an unannounced Tetris title
• Telltale's The Walking Dead collection - A potential compilation of the complete Telltale series
• Twin Peaks game - Test achievements including "Welcome to Twin Peaks - Reached the Double R Diner" were found

The Twin Peaks game achievement was among the most surprising finds. The test achievement referenced the iconic Double R Diner from the television series. It is unclear whether this represents an active project or an abandoned prototype. No publisher or developer has been linked to the Twin Peaks achievement data.

Many entries in the leak were represented only by Steam App ID numbers. These IDs correspond to games that Valve has in its system but that have not been publicly named or announced. Gaming outlets attempted to match some IDs to known projects, but many remain unidentified.

Animal Crossing-style Nickelodeon game drew immediate attention on social media. The combination of a life simulation format with Nickelodeon properties suggests a game aimed at younger audiences. No developer or release window was associated with the achievement data.

Valve's Second Security Incident in Two Weeks

The API leak on September 8-9 marks the second major Valve security incident in less than two weeks. In late August 2026, approximately 12TB of data from Steam's internal archives between 2003 and 2013 was leaked publicly. That data included game builds, beta versions, prototypes, and internal documentation from early Steam development.

The late August leak included early prototypes of Portal 2, pre-release builds of Mirror's Edge, Call of Duty 4 development builds, and various Spore prototypes. According to reports at the time, the data was available through a publicly accessible directory, not through any form of hacking or unauthorized access.

Both incidents share a common thread: publicly accessible data that should have been restricted. The late August leak exposed internal development files through an open directory. The September API leak exposed private achievement data through legitimate API endpoints. Neither incident required any technical exploitation beyond accessing publicly available resources.

Noisy Pixel's Azario Lopez reported that the back-to-back incidents have raised questions about Valve's internal data management practices. Achievement data for unreleased titles should never appear through public API endpoints. The fact that it did, just two weeks after a separate major leak, suggests systemic issues with how Valve handles data access controls.

Valve has not issued a public statement about either incident as of September 9, 2026. The company typically does not comment on security matters publicly. However, the scope of both leaks and the number of affected publishers may prompt a response.

Complete Games Comparison Table

The following table lists all major games confirmed affected by the Steam API leak on September 8-9, 2026. Data compiled from reports by VGC, Noisy Pixel, RPG Site, Press Start, NintendoEverything, GamesRadar, Gematsu, and Game Rant.

Kingdom Hearts 4 Leaked Worlds vs Confirmed Worlds

Frequently Asked Questions

What exactly happened with the Steam API leak?

On September 8, 2026, Steam's public API began returning achievement data for games that should have been private. Achievement tracking services that automatically scan the API, including Exophase, picked up hundreds of new entries. The data was accessible through legitimate API endpoints that Valve normally restricts to released or announced titles. Exophase owner Mike Bendel confirmed on ResetEra that the indexing was automatic and that the data appeared through normal API monitoring. The issue was not a hack or unauthorized access. It was a misconfiguration that made private data publicly visible.

Which games were affected by the leak?

The leak affected hundreds of titles, but the most notable include Kingdom Hearts 4, Persona 6, Persona 4 Revival, Fable, Gears of War: E-Day, Silent Hill: Townfall, Tomb Raider: Legacy of Atlantis, Final Fantasy Resonance, Mega Man: Dual Override, Crazy Taxi: World Tour, Castlevania: Belmont's Curse, Metro 2039, Turok Origins, Ace Combat 8, Trails in the Sky 2nd Chapter, and Danganronpa 2x2. Many other titles were identified only by Steam App ID numbers without official names. Reports from VGC, Noisy Pixel, RPG Site, Press Start, NintendoEverything, GamesRadar, Gematsu, and Game Rant all documented the affected games.

What Kingdom Hearts 4 worlds were revealed?

The leaked achievement data confirmed eleven worlds for Kingdom Hearts 4. The most significant reveal was Galaxy Far, Far Away, a Star Wars world with achievements "Desert Do-Gooder" and "May the Light Be with You." Other confirmed worlds include Coco, Toy Box (Toy Story), Haunted Mansion, Monochrome Origins, Zootopia, Underworld (Hercules), Imagineer Planet, Hundred Acre Woods, Scala Ad Caelum, and Quadratum. Kingdom Hearts 4 launches on Nintendo Switch 2 in 2027. Achievement data was reported by Press Start, NintendoEverything, and RPG Site. Note: full achievement lists are not included here to avoid excessive spoilers.

What Persona 6 details were revealed?

Persona 6 is set in Yokohama, Japan, with a main group called "Hex." Achievement data referenced social links, dungeon exploration, and the calendar system from previous Persona games. No release date or platform was confirmed through the leak. Atlus has not officially announced Persona 6. The achievement data appeared before any gameplay footage was shown publicly. Details were reported by Noisy Pixel and RPG Site. Achievement structure follows the pattern established by Persona 5, with calendar-based progression and social link achievements.

How can I avoid spoilers from this leak?

Several gaming outlets published detailed coverage of the leaked achievement data. To avoid spoilers, do not search for "Steam API leak" or "Kingdom Hearts 4 achievements" on social media or gaming forums. Be cautious when browsing ResetEra, Reddit, or Twitter where the data was widely shared. Block or mute keywords related to the leaked games. Achievement lists for Kingdom Hearts 4 and Persona 6 contain significant story and gameplay spoilers. This article includes spoiler warnings before those sections but does not contain full achievement lists to minimize exposure.

Has Valve responded to the leak?

Valve has not issued a public statement about the September 8-9 API leak as of September 9, 2026. The company also did not publicly comment on the 12TB data leak from late August 2026. Valve typically does not make public statements about security incidents. The back-to-back incidents, both involving publicly accessible data that should have been restricted, have raised questions about Valve's data management practices. Noisy Pixel reported that the lack of official response has been noted by the gaming community. Publishers affected by the leak have also not issued statements.

Sources and Attribution

• Chris Scullion, VGC - September 9, 2026 reporting on the full scope of affected games and Valve's lack of response
• Azario Lopez, Noisy Pixel - September 8-9, 2026 coverage of the leak discovery and Persona 6 details
• Mikhail Madnani, RPG Site - September 9, 2026 detailed reporting on Kingdom Hearts 4 and Persona 6 achievement data
• Shannon Grixti, Press Start - September 9, 2026 Kingdom Hearts 4 world details and achievement analysis
• Brian, NintendoEverything - September 9, 2026 reporting on Nintendo Switch 2 launch details for Kingdom Hearts 4
• Anna Koselke, GamesRadar - September 9, 2026 analysis of Kingdom Hearts 4 achievement counts and scope
• Gematsu - Original report citing Exophase and Mike Bendel's ResetEra posts
• Drew Swanson, Game Rant - September 9, 2026 coverage of unannounced and cancelled games found in the leak
• Mike Bendel (x3sphere), Exophase - ResetEra posts confirming the API issue and automatic indexing

All information in this article is attributed to the sources listed above. Achievement data was indexed by Exophase through public API endpoints. No hacking or unauthorized access was involved in the data collection. This article does not include full achievement lists to avoid reproducing spoilers excessively.

Labels: PC Gaming

Byline: Indie Kings, September 9, 2026