A Steam backend slip has done what publishers spend years and NDAs trying to prevent: it handed the internet achievement lists for Persona 6, Kingdom Hearts IV, and dozens of other unreleased or unannounced games in one shot. The lists surfaced on Exophase, the trophy and achievement-tracking site that quietly scans Steam’s public API for new entries, and within hours screenshots were circulating across Reddit, ResetEra, and gaming forums worldwide. As of September 9, 2026, neither Atlus nor Square Enix has issued an official statement confirming or denying the leaked contents.
The story has been reported by Gematsu, GAMINGbible, PlayDayOne, Video Games Chronicle, MP1st, and ixbt.games, among others, making this one of the most widely corroborated Steam data leaks of the year. Reports diverge on the exact scale: one count puts the number of affected games at 145, while another figure circulating in coverage lands at 85. Either way, this is not a narrow leak involving one or two titles. It is a sprawling exposure that touches some of the most anticipated releases in gaming.
What Actually Leaked, and Where
The leak traces back to Exophase, a third-party site that has spent more than a decade indexing Steam, PlayStation, and Xbox achievement and trophy data as it becomes publicly visible through official APIs. Exophase does not hack anything; it scrapes what Steam’s own API exposes. That is precisely what makes this incident notable. If achievement lists for unannounced games appeared on Exophase, then Steam’s backend made that data reachable, whether by accident or by a misconfigured privacy flag.
Among the games named in reporting, two titles dominate the conversation: Persona 6 and Kingdom Hearts IV. Both are sequels to franchises with enormous, patient fanbases, and both have been the subject of rumor and speculation for years without an official reveal. Seeing their achievement structures pop up on a public tracker, unannounced, is the kind of leak that turns a quiet Tuesday into a trending topic across gaming press within hours.
Persona 6’s leaked list reportedly contains 48 achievements. Multiple outlets note that the list references a Yokohama setting and an organization called Hex, details that, if accurate, would mark some of the first concrete story information the public has seen for the long-rumored sequel. Kingdom Hearts IV’s list is reported at 50 achievements, with references to several worlds: a Star Wars world, Toy Box, Scala ad Caelum, Quadratum, Monochrome Origins, and Imagineer Planet. Some of those names, like Scala ad Caelum and Quadratum, will be familiar to players who finished Kingdom Hearts III’s Re Mind DLC, suggesting narrative continuity rather than a full reboot.
Why Achievement Leaks Carry Real Spoiler Risk
Achievement lists sound like a minor thing to leak compared to a full script or a build of the game, but veteran players know better. Trophy and achievement names are written by developers to reward specific story beats: a boss defeated, a character recruited, a plot twist resolved. A list of 50 achievement titles, read in order, often sketches the shape of a game’s back half well before anyone has played a second of it.
That is the core tension driving coverage of this leak. Fans who want to stay spoiler-free for Persona 6 or Kingdom Hearts IV now have to actively avoid a specific category of content, achievement roundup articles and forum threads, on top of the usual leak avoidance. For franchises where mystery has been part of the marketing (neither Atlus nor Square Enix had formally announced either title with a release window before this leak surfaced), that is a bigger deal than it looks on paper.
It is also worth separating what is confirmed from what is speculation. The exact cause of the leak has not been officially confirmed by Valve, Atlus, or Square Enix. Reports describe it as tied to a Steam backend or API issue following recent maintenance, and a widely circulated Reddit post states plainly that “there was no intentional leak,” attributing the exposure to Valve mishandling its own API rather than any external breach or malicious hack. That distinction matters: this looks like an infrastructure failure, not a targeted theft of data.
The Scale Question: 85 Games or 145?
One of the messier parts of tracking this story in real time is that outlets do not agree on how many games were swept up. At least one report puts the figure at 145 games affected, while a separate count lands at 85. Both numbers describe the same underlying event; the gap likely comes down to differing definitions of what counts as “affected,” whether that means a full achievement list appeared, a game’s existence was merely confirmed on Exophase, or partial metadata leaked without a complete list.
Until Valve, Atlus, or Square Enix comment directly, readers should treat both figures as directionally accurate rather than precise. What is not in dispute across any outlet’s coverage is that this ranks among the largest simultaneous Steam achievement exposures on record, dwarfing the isolated single-game leaks that typically make gaming news.
| Detail | Persona 6 | Kingdom Hearts IV |
|---|---|---|
| Achievements reportedly leaked | 48 | 50 |
| Setting/world references named in reports | Yokohama | Star Wars world, Toy Box, Scala ad Caelum, Quadratum, Monochrome Origins, Imagineer Planet |
| Named organization/group in leak | Hex | Not specified in current reporting |
| Official confirmation from publisher | None as of September 9, 2026 | None as of September 9, 2026 |
| Source of leak | Exophase (Steam API data) | Exophase (Steam API data) |
Persona 6: What the Leak Suggests
Persona has been one of Atlus’s most reliable franchises since Persona 5’s breakout success, and speculation about a sixth mainline entry has simmered for years without an official trailer. The leaked achievement list, if accurate, is the closest thing fans have to concrete evidence about the game’s setting. A Yokohama backdrop would be a meaningful departure in flavor from Persona 5’s Tokyo and Persona 4’s rural Inaba, giving the series a fresh urban texture to build its social-link and dungeon-crawling loop around.
The reported organization name, Hex, reads like it could be either the antagonist faction players spend the game investigating or the protagonist’s own crew, in the Persona tradition of naming the player’s in-game social group (the Investigation Team, the Phantom Thieves). Without additional context from an official reveal, it is impossible to say which. That ambiguity is exactly why achievement-list leaks generate so much discussion: they hand out just enough detail to fuel theorycrafting without ever resolving it.
Kingdom Hearts IV: Piecing Together the Worlds
Kingdom Hearts IV was teased by Square Enix in 2025 with a Disney partnership already baked into the announcement, so a Star Wars world reference in the leaked achievements would fit a series that has spent two decades blending Disney and Final Fantasy IP inside a single adventure. What is more interesting to longtime fans is the reappearance of Scala ad Caelum and Quadratum, both locations tied directly to Kingdom Hearts III’s Re Mind epilogue and the mysterious Verum Rex thread that has been dangling since that DLC shipped.
Toy Box, Monochrome Origins, and Imagineer Planet round out the reported world list, according to a breakdown from Kotaku. Toy Box echoes Kingdom Hearts III’s Toy Story-inspired world, while Monochrome Origins and Imagineer Planet read as entirely new names with no clear precedent in the series. If the leak holds up, it suggests Kingdom Hearts IV is threading a needle between closing out lingering Kingdom Hearts III plot threads and opening fresh Disney-world territory, rather than doing a hard reset.
How This Compares to Past Steam Leaks
Steam has a long, awkward history of accidentally revealing games before their publishers wanted them revealed. Achievement lists, depot names, and store page metadata have leaked unannounced titles for years, because Valve’s backend systems are built for scale and speed, not for airtight compartmentalization between public and private data. Earlier this year, a 12TB Steam leak exposed internal files tied to Valve’s own Half-Life 2, and a separate Switch 2 leak surfaced Smash Bros and Nintendogs details across six outlets months before either publisher was ready to talk. What sets this incident apart is not the mechanism, it is the sheer breadth: dozens of titles at once, rather than a single game slipping through a misconfigured depot.
As RPG Site’s coverage notes, the comparison that matters most for readers trying to gauge how seriously to take this is scale versus precedent. A single leaked achievement list is common enough that it barely makes news outside dedicated leak-tracking communities. A leak touching somewhere between 85 and 145 games, surfacing on a third-party site with no hacking involved, is a different category of event, one that points to a systemic backend issue rather than a one-off mistake by a single developer’s Steamworks configuration.
| Leak Type | Typical Scale | Typical Cause | How This Leak Compares |
|---|---|---|---|
| Single-game achievement leak | 1 game | Developer misconfigures Steamworks privacy setting | Far smaller than this incident |
| Depot name leak | 1-3 games | Public depot metadata exposed pre-announcement | Different mechanism, similar unofficial-reveal effect |
| This leak (Persona 6, Kingdom Hearts IV, others) | 85 to 145 games (reports vary) | Reported Steam backend/API exposure after maintenance | Among the largest simultaneous achievement exposures reported |
| Full build/source leak (historical examples) | 1 game, but far deeper data | Server breach or insider leak | More severe per-game, but rarely spans dozens of titles at once |
The Valve API Angle: An Accident, Not a Breach
It is important to separate this event from a hack in the traditional sense. Nobody appears to have broken into Valve’s servers or exfiltrated private data through a security exploit. Instead, the working theory circulating in community discussion, including a widely shared Reddit post stating there was no intentional leak, is that Steam’s own API briefly served achievement data that should have remained private, likely as a side effect of routine backend maintenance.
Exophase’s scanning process simply did what it always does: it polled the public API and indexed whatever came back. That is a meaningfully different story than a malicious actor targeting Valve or targeting specific publishers. For readers used to breach headlines involving stolen credentials or ransomware groups, this is closer to a permissions bug than an attack. It still results in real information reaching the public before publishers intended, but the “attacker” here is closer to a misconfigured access control list than a threat actor.
Market and Industry Impact
Leaks like this rarely move stock prices or reshape quarterly guidance, but they do have a measurable effect on how publishers plan announcements. Atlus and Square Enix both operate on carefully staged reveal calendars, timed around events, anniversaries, and marketing budgets that assume the publisher controls the moment of first contact with the audience. When an achievement list beats the official trailer to the internet, it does not kill hype, but it does dilute the impact of the eventual reveal and forces PR teams into a reactive posture rather than a proactive one.
There is also a broader industry angle worth noting. Steam’s dominance as the PC storefront of record means that any systemic backend issue on Valve’s side has outsized reach, touching publishers across the industry simultaneously rather than isolating risk to one company’s infrastructure. That is the trade-off of a platform as consolidated as Steam: efficiency for developers and players, but a single point of failure when something in the plumbing goes wrong.
Community Reaction Across Platforms
The leak spread fast through the usual channels: Reddit threads dedicated to both the Persona and Kingdom Hearts communities, ResetEra megathreads compiling screenshots, and roundup coverage from outlets including Gematsu, GAMINGbible, PlayDayOne, Video Games Chronicle, MP1st, and ixbt.games, alongside additional write-ups from TheGamer and Noisy Pixel. The tone across these communities splits roughly into two camps. One group is combing through every leaked achievement title for clues, treating the leak as a genuine, if unofficial, first look. The other is actively avoiding threads and articles, frustrated that a backend error has taken away their ability to experience an eventual official reveal unspoiled.
That split is not unique to this leak, it shows up every time a big unannounced game’s details escape early. A Smash Bros leak that ended an eight-year wait for Ultimate fans and a Super Metroid remake leak that surfaced 32 years after the original both followed the same pattern of forum-driven detective work outpacing official confirmation. The scale of this leak, spanning dozens of titles, only amplifies that dynamic. With reports describing dozens of games swept into a single incident, players who care about franchises well beyond Persona and Kingdom Hearts are having to make the same spoiler-avoidance calculation, whether they follow Dragon Ball, Tomb Raider, or any of the other titles named across the various reports.
What Remains Unconfirmed
It is worth being precise about the boundary between what multiple outlets have corroborated and what is still speculative. The exact root cause of the leak beyond “a Steam backend or API issue” has not been officially confirmed by Valve. Neither Atlus nor Square Enix has issued a statement addressing the leaked achievement lists at all, let alone confirmed their contents as accurate final builds. Several outlets covering the story use qualifiers like “reportedly,” “appears,” or “seemingly” specifically because the achievement text has not been independently verified as final, or even as genuine, by the publishers involved.
That caveat matters for two reasons. First, achievement lists can and do change between an early build and a shipped game, so even if the leak is entirely genuine, some names or references could shift before release. Second, without a publisher statement, there is a nonzero chance that some of the granular details circulating in forum threads and secondary coverage have been exaggerated or misread in translation from the original Exophase listings. Readers should treat the broad strokes, that a major leak happened, that it affects Persona 6 and Kingdom Hearts IV, that it traces back to Exophase and a Steam API exposure, as solid, while treating any specific plot inference drawn from an achievement title as speculative until Atlus or Square Enix weighs in.
How Publishers Typically Respond to This Kind of Leak
History offers a fairly predictable playbook. When achievement or metadata leaks happen ahead of an official announcement, publishers generally take one of three paths: stay silent and let the reveal happen on the originally planned schedule, accelerate the announcement to get ahead of the narrative, or issue a brief acknowledgment without confirming specifics. Square Enix and Atlus have each used silence as a default response to smaller leaks in the past, letting community chatter run its course rather than feeding the story with an official comment.
Given the scale of this particular leak, and the fact that it implicates Valve’s own infrastructure rather than either publisher’s internal security, there is a reasonable chance both companies simply wait it out. Commenting invites more scrutiny of exactly which details are accurate, which is rarely in a publisher’s interest while a game is still deep in development and years from a confirmed release window.
What This Means for Steam’s API Going Forward
For Valve, the more pressing question is not this single incident but whether it exposes a structural weakness in how Steamworks handles achievement privacy flags at scale. Third-party trackers like Exophase exist precisely because Steam’s API is open enough to support a healthy ecosystem of community tools, leaderboards, and completion trackers. That openness is a feature, not a bug, for the vast majority of Steam’s catalog. The problem is narrower: making sure privacy settings for pre-release, unannounced titles are enforced consistently, especially around maintenance windows when backend configurations are most likely to shift.
If this incident does trace back to a maintenance-related misconfiguration, as community reporting suggests, the fix is likely to be an internal process change on Valve’s side rather than a public API overhaul. Valve rarely comments publicly on backend infrastructure issues unless they cause outright service outages, so most observers should not expect a detailed post-mortem, only, potentially, a quiet tightening of how achievement visibility is gated before a game’s store page goes live.
Predictions: Where This Story Goes Next
A few things seem likely to play out over the coming days and weeks. First, expect continued aggregation coverage as more outlets comb through the full leaked list beyond Persona 6 and Kingdom Hearts IV, since a leak spanning dozens of games rarely gets fully catalogued in the first 24 hours. Second, both Atlus and Square Enix will most likely avoid direct comment on the specific leaked content, sticking to the industry-standard approach of letting the news cycle move on rather than confirming details ahead of their own marketing timelines.
Third, Exophase itself may face pressure, informal or otherwise, to review how it handles data that appears to belong to clearly unannounced titles, even though the underlying data came from Steam’s own public API rather than any action taken by Exophase against Valve’s wishes. Fourth, expect renewed scrutiny anytime either Persona 6 or Kingdom Hearts IV is eventually announced officially, with early coverage inevitably referencing this leak as a point of comparison for what turned out to be accurate. Fifth, and more broadly, this incident will likely get cited as a cautionary example the next time a similar Steam backend exposure happens, reinforcing a pattern where achievement and metadata leaks are treated as a recurring, low-severity but high-visibility risk of operating on a platform as large as Steam.
The Bigger Picture for Persona and Kingdom Hearts Fans
Setting aside the mechanics of the leak, the fan-facing reality is simpler: two of the most anticipated sequels in modern gaming just had their first real details surface, months or years before either publisher planned to reveal them. For a franchise like Persona, where each mainline entry becomes a cultural moment on release, that is a genuine disruption to the marketing runway Atlus would otherwise control. For Kingdom Hearts, a series whose fanbase has spent years parsing cryptic trailers and secret endings for narrative clues, an unofficial world list is almost irresistible material for theorycrafting communities that thrive on exactly this kind of ambiguous, half-confirmed information.
Whether the leaked details hold up exactly as reported will only become clear once Atlus and Square Enix choose to speak. Until then, this remains a story defined as much by what is not confirmed as by what leaked: real achievement data, from a real Steam backend exposure, describing games that remain, officially, unannounced. It joins a growing list of 2026 leaks across the gaming industry, including a recently leaked Final Fantasy Resonance demo that landed on Switch 2 and Switch ahead of its official rollout.
Frequently Asked Questions
What exactly leaked in the Persona 6 and Kingdom Hearts IV Steam achievement leak?
Achievement lists for Persona 6, Kingdom Hearts IV, and a large number of other unreleased or unannounced games surfaced on Exophase, a third-party Steam achievement tracking site. Reports put Persona 6’s list at 48 achievements and Kingdom Hearts IV’s at 50, with references to settings and world names that had not been officially confirmed before.
How many games were affected by the Steam achievements leak?
Reports differ. One count places the number of affected games at 145, while another puts it at 85. Both figures describe the same underlying incident, and the discrepancy likely reflects different definitions of what counts as an affected title.
Did Valve confirm the cause of the leak?
No official statement from Valve had confirmed the exact cause as of September 9, 2026. Community reporting, including a widely shared Reddit post, points to a Steam backend or API issue following maintenance, describing it as unintentional rather than the result of a hack or breach.
Have Atlus or Square Enix officially responded?
No. Neither publisher had issued a statement addressing the leaked achievement lists for Persona 6 or Kingdom Hearts IV as of this writing. Historically, both companies have tended to stay silent on smaller leaks rather than confirm or deny specific details.
What is Exophase, and why did the leak appear there?
Exophase is a long-running achievement and trophy tracking site that indexes data from Steam, PlayStation, and Xbox as it becomes publicly accessible through official APIs. It does not hack platforms; it scans what those APIs expose. The leak appeared there because Steam’s backend reportedly made private achievement data for unannounced games briefly reachable through the public API.
Is the leaked information about Persona 6 and Kingdom Hearts IV confirmed to be accurate?
Not officially. Several outlets covering the leak use qualifiers like “reportedly” and “appears” because the achievement text has not been independently verified as final or genuine by either publisher. Achievement lists can also change between early builds and a shipped game.
Does this leak reveal a release date for either game?
No. Nothing in the current reporting on the achievement leak includes a confirmed release date for Persona 6 or Kingdom Hearts IV. Both remain officially unannounced or unconfirmed for a specific launch window.
How does this compare to other Steam leaks in the past?
Most Steam achievement or metadata leaks involve a single game slipping through a misconfigured setting. This incident is notable mainly for its scale, touching dozens of titles from multiple publishers simultaneously, which points to a broader backend issue rather than an isolated developer mistake.
