A Sea of Spoilers: Massive Steam Achievement Leak Exposes Persona 6, Kingdom Hearts 4, and Unannounced Remasters

The global video game industry is grappling with one of its most significant metadata breaches in years. Exophase, a prominent third-party platform dedicated to tracking player achievements across major gaming ecosystems—including Steam, PlayStation Network, Xbox Live, and GOG—has been flooded with a massive wave of unreleased achievement lists.

The leak, which remains officially unverified but carries immense technical credibility, has exposed critical plot details, gameplay mechanics, and the existence of several highly anticipated, unannounced titles. Among the most shocking revelations are detailed achievement profiles for Persona 6, Kingdom Hearts 4, Deus Ex Remastered, and a Steam release for Squadron 42, the long-delayed single-player companion to Star Citizen.

This unexpected exposure has bypassed traditional marketing timelines, giving the public an unprecedented look behind the curtain of major publishers, including Atlus, Square Enix, and Sony Interactive Entertainment.

Chronology: How the Metadata Leak Unfolded

The leak began quietly in late January, when automated scrapers and database monitors noticed an anomalous surge of new game profiles on Exophase. Unlike standard updates, which typically correspond to games entering active beta phases or nearing their official launch dates, these new entries featured internal Steam AppIDs that had not yet been registered publicly on Steam’s storefront.

[Exophase Scraper detects new Steam AppID] 
       │
       ▼
[Automatic API Pull of localized achievement text & icons]
       │
       ▼
[Community Discovery: Reddit (r/KingdomHearts, r/GamingLeaksAndRumours)]
       │
       ▼
[Viral Dissemination: Twitter/X, Gaming Media outlets]
       │
       ▼
[Publishers scramble to lock down Steamworks backend settings]

Within hours, users on Reddit’s r/GamingLeaksAndRumours and dedicated franchise subreddits like r/KingdomHearts began cross-referencing these AppIDs. They discovered that the achievement lists contained highly specific, localized text strings, unique trophy icons, and clear narrative progression markers that would be nearly impossible to forge at this scale.

This incident has drawn immediate comparisons to the infamous September 2021 NVIDIA GeForce NOW leak. In that instance, an architectural vulnerability in NVIDIA’s database exposed a massive internal list of titles slated for PC release, many of which seemed highly speculative at the time (including the Chrono Cross remaster, God of War for PC, and Kingdom Hearts IV itself). Over the subsequent three years, nearly every title on that list was officially announced or released. Industry analysts suggest the Exophase leak is the spiritual successor to the NVIDIA breach, serving as a concrete roadmap for the next three to four years of PC gaming.

Supporting Data: Deep Dive into the Leaked Titles

The sheer volume of data exposed on Exophase provides a granular look at several major intellectual properties. Below is an analysis of the most prominent leaks and what the metadata reveals about these upcoming projects.

Persona 6 (Atlus)

Perhaps the most surprising inclusion is Persona 6. Developer Atlus has not yet shown official gameplay footage or even confirmed a definitive release window for the next mainline entry in its flagship JRPG franchise.

The leaked achievement list on Exophase, however, suggests that development is much further along than public relations campaigns indicate.

• Narrative Spoilers: The list contains specific achievements tied to social links, dungeon completions, and late-game boss fights.
• Mechanical Insights: The achievements point to a return of the series’ signature calendar system, but with new combat mechanics and exploration activities that suggest a major structural evolution from Persona 5.
• Spoilers Alert: Fans who wish to experience the narrative fresh have been widely warned to avoid Exophase and associated forums, as the achievement names openly detail character betrayals and major plot twists.

Kingdom Hearts 4 (Square Enix)

Square Enix’s highly anticipated crossover sequel, currently projected for a tentative 2027 release window, has had its narrative structure laid bare.

On Reddit, fans have meticulously dissected the trophy requirements to piece together the game’s world selection.

• Disney Integration: The achievements corroborate long-standing rumors regarding which Disney and Pixar intellectual properties will feature in Sora’s next adventure.
• The "Quadratum" Arc: Multiple achievements refer to progression within "Quadratum," the realistic, metropolitan world introduced at the end of Kingdom Hearts 3 and featured in the initial Kingdom Hearts 4 teaser trailer.
• Progression Systems: Specific trophies reward players for mastering new movement mechanics, suggesting a heavier emphasis on traversal and verticality than in previous entries.

Squadron 42 (Cloud Imperium Games)

Squadron 42, the star-studded single-player campaign set in the Star Citizen universe, was recently delayed by Cloud Imperium Games (CIG) to the second quarter of 2027. Historically, CIG has distributed its builds exclusively through its proprietary Robert Space Industries (RSI) launcher, bypassing third-party storefronts.

The Exophase leak reveals a dedicated Steam achievement list for Squadron 42 (associated with AppID 4045720). This strongly indicates that CIG plans a simultaneous or close-proximity release on Valve’s platform to maximize its commercial reach upon launch—a major strategic shift for the crowdfunding giant.

Unannounced Projects and Remasters

The leak also shed light on several unannounced titles and heavily rumored remasters:

Other notable entries include Attack on Titan 3, Horizon Hunters Gathering, Star Wars: Galactic Racer, and Stranger Than Heaven.

Technical Analysis: How Steamworks Metadata Leaks

To understand how this leak occurred, one must look at the architecture of Valve’s developer backend, Steamworks.

When developers prepare a game for eventual release on Steam, they are assigned a unique application identifier (AppID). Within this private backend environment, developers configure store pages, upload build branches, and set up achievements.

[Developer Backend (Steamworks)]
  │
  ├─► Game Builds (Private/Encrypted)
  └─► Achievement Schema (Often Left Publicly Queryable via WebAPI)
        │
        ▼ (Automated Request)
      [Steam WebAPI / GetSchemaForGame]
        │
        ▼ (Scraped by)
      [Exophase / SteamDB Database]

Steam’s WebAPI allows third-party services like Exophase to query achievement schemas using the GetSchemaForGame method. If a developer uploads their achievement localized strings and icons to the Steamworks database but fails to restrict the visibility permissions or leaves the AppID state as queryable, automated scrapers can pull this information.

Because Exophase is designed to automatically populate its database as soon as new achievement data is detected via API calls, these unreleased, unnamed games were automatically published to the public-facing site, complete with their localized titles and trophy descriptions.

Official Responses and Developer Context

As of writing, Valve has not issued a formal public statement regarding the breach. The company typically addresses backend security issues quietly by patching API vulnerabilities or updating developer guidelines.

The developers and publishers affected by the leak have responded with varying degrees of urgency:

• Atlus / Sega: Have historically taken a zero-tolerance approach to leaks, frequently issuing DMCA takedown notices to fansites and social media accounts sharing leaked assets. Behind-the-scenes efforts are reportedly underway to scrub the Persona 6 achievement details from public archives.
• Square Enix: Has not commented on the Kingdom Hearts 4 leak, though community moderators on platforms like Reddit have begun self-policing threads to protect users from unwanted story spoilers.
• Cloud Imperium Games: Has kept its focus on the ongoing development of Star Citizen, neither confirming nor denying the implications of a Steam release for Squadron 42.

Industry Implications: The Cost of Pre-Release Exposure

The Exophase leak highlights a growing vulnerability in the modern video game marketing machine. Publishers rely heavily on carefully orchestrated reveal schedules, designed to maximize consumer excitement and media coverage at major events like Summer Game Fest, Gamescom, or The Game Awards.

The Death of the "Shadow Drop" and Surprise Reveals

When achievement lists leak years in advance, publishers lose the element of surprise. Marketing campaigns for games like Persona 6 must now contend with a fanbase that already knows major plot points, potentially dulling the impact of official trailers and narrative setups.

Security vs. Convenience in Development

This leak underscores the delicate balance between developer convenience and data security. To test achievements thoroughly, QA teams need them integrated into the platform’s active backend. However, leaving this metadata exposed to public-facing APIs presents a constant risk.

Moving forward, Valve may be forced to implement stricter default privacy settings within Steamworks, requiring developers to explicitly opt-in to public API visibility for achievements prior to a game’s official store page launch. Until such measures are standardized, third-party databases will continue to serve as an accidental crystal ball for the gaming industry.