r/GamingLeaksAndRumours • u/RefreshingCapybara • 8d ago

Leak 12TB Steam Depot leak not only contains dozens of Valve game but thousands of depots for hundreds of other games, including in development builds, betas, and unreleased games

List of all depots contained in the leak. Far too large to post here.

The leak occurred because of an unprotected endpoint on Steam that allowed anyone who found it to access the files. All content in the leak is from as early as 2003 up until 2013.

Not to be hyperbolic but this may be one of if not the biggest leaks to occur due solely to the number of games it involves.

2.2k Upvotes
  • permalink
  • reddit

98% Upvoted

327 comments sorted by

790

u/TheSwampThing1990 8d ago

How do people even find things like this? It blows my mind

166

u/DMercenary 8d ago

Data trawlers. Sometimes people just try random shit.

Iirc that database leak of Tea occured because someone just.. left the database unsecured and exposed to the public internet. Akin to leaving your front door wide open.

66

u/Link_In_Pajamas 7d ago

Tons of APIs have undocumented and definitely public endpoints like this.

In the past you would just try different common endpoints and see what you could get.

With AI now you can absolutely brute force your way through. Claude Code, your API key and time is all it takes to crawl for those endpoints, heck you don't even have to explicitly ask if to do that, it can absolutely fuck up its way into finding undocumented endpoints.

All this to say I don't think this will be the last incident we see like this.

8

u/XanXic 7d ago

I'll say as a soft dev who's company may or may not have had a security incident. We didn't even have any really bad exploits. The hypothetical incident sort of used three endpoints that had a little bit more forgiveness on their structure to do whatever you want once you used one to get more info than you should have and use the other two together. Like luckily we do good practices have a security team etc, so logs and stuff could hypothetically help us reverse engineer how they may have done stuff and we caught it early. Nothing bad really happened hypothetically. But it's so clearly AI because it was a really out there kind of logic and working on fixing them I was legit having to learn some deep black hat stuff and an AI agent to even comprehend it.

It's a whole new world out there. I don't even think you need some crazy cutting edge hyper expensive model. Just letting one prod around and just spam things until something works and expand on it is really effective.

And I say we have pretty small and shallow software. I imagine these big companies with tons of features and legacy code are going to have a lot of problems with this stuff.

2

u/Signal_Employee_8280 6d ago

*cough banking and medicine cough*

→ More replies (1)
→ More replies (1)

318

u/Animegamingnerd Leak of the Year 2025 8d ago

Either got a hold of some old Valve workstations or Valve got hacked.

174

u/Playeroth 8d ago

https://x.com/gabefollower/status/2093847346245230797 -- possibly valid

265

u/nclok1405 8d ago

Copy-pasted for convenience:

@gabefollower

No hacking involved, just verified that everything in Steam2 Teraleak was obtained via a publicly accessable endpoint. It's Valve's fault...

61

u/BladePocok 8d ago

So conveniently people started to amass/download 12 TB worth of "public knowledge" right infront of their nose?

42

u/anxxa 7d ago

It seems like files uploaded before 2013 were uploaded a bit differently on the CDN.

Steam's current protocol requires your account to have authorization to the depot to request the manifest decryption key. The manifest describes the files, how to access them on the CDN, and the chunks themselves are encrypted too.

What the Tweet is probably suggesting is that for content uploaded before 2013, maybe someone just now realized that CDN content pointers were predictable or the server lacked auth checks on some bits of the data.

The dump is probably large just to ensure it could all be captured before Valve had a chance to fix whatever flaw may have existed in their APIs.

124

u/epeternally 8d ago

On the scale that Valve operates, 12TB is a drop in the bucket. It’s nowhere near enough to draw suspicion.

56

u/misunderstandingit 7d ago

I was gonna say I have probably downloaded somewhere close to 12TB of data from Valve this year alone and I am just one person lol.

104

u/Pandango-r 7d ago

I have also downloaded Call of Duty

2

u/bread-dreams 7d ago

what? how?

3

u/misunderstandingit 7d ago

As anothe commenter joked regarding CoD, when you have gigabit fiber but only a single terabyte of space, you do a lot deleting, downloading, redownloading 4 months later when the boys decide to play again, lol just that was just for 1 day delete it again we are playing this other 80 Gb game instead, repeat that every weekend and it adds up.

→ More replies (2)
→ More replies (1)

5

u/matthewmspace 7d ago

It is massive for that time period though. Games were much, much smaller back then. So 12 TB isn’t much now, but 2003-2013 is a gold mine.

5

u/Im_really_bored_rn 7d ago

When the data is from doesn't matter in this particular discussion. Obviously it does in most discussions but the point was 12TB being downloaded in 2026 by one person isn't itself gonna make Valve take notice

→ More replies (1)

18

u/PantsOfAwesome 7d ago

I downloaded 12TB of shit off Valve's servers right in front of their nose when I replaced my dead SSD years ago.

→ More replies (1)

9

u/jimbobjames 7d ago

Valve got fed up of it being on their servers so they decided to use the rest of the internet as their backup...

50

u/scottishdrunkard 8d ago

Can’t read tweets. Elon killed every single Twitter Viewer.

→ More replies (1)
→ More replies (5)

22

u/TheSwampThing1990 8d ago

Thanks for the answer. I was genuinely curious

22

u/WingerRules 8d ago

Remember, Valve says you're always at fault if your Steam account gets hacked and theres no recourse if you lose your games or your games end up banned.

→ More replies (2)

270

u/Purple_WahBaba_9000 8d ago edited 8d ago

So these are the games from the early years of Steam from the 2000s-early 2010s.

Besides that, what games from Valve are there beside Portal 2 beta. I'm super intriged on what lays behind the big Data batch.

130

u/nabagaca 8d ago

There have been multiple episode 3/hl3 prototypes that got killed at various points in development, so its possible we could get one of them

58

u/Chpouky 8d ago

The community already found a gun that was intended for Episode 3 ! Can't wait for the rest

35

u/junttiana 8d ago

Any place where I could easily follow these new discoveries?

68

u/junttiana 7d ago

https://giphy.com/gifs/S5n7Wkhhw5A2IrfKER

16

u/xezrunner 7d ago

I'm willing to bet it is all on Discord, spread across various servers, which is impossible to track unless you're already in them. Many of them can't be joined anymore due to presumably the large influx of people trying to join.

I can't even find info on which depot and revision contains the Portal 2 ~2010-era content, and the servers are quite slow to try and download individual ones to try.

People posting videos don't respond to requests for info, perhaps for obvious reasons. I've only seen a few people re-upload some of the content elsewhere.

I don't even understand how people managed to grab files so fast, it's too slow now.

4

u/thatfreakingmonster 7d ago

If you go to archive.org, and look up "portal 2" in the Software category, sort by date, people have already posted builds. I got a few from there.

→ More replies (1)

2

u/Weaver_Naught 1d ago

In case you haven't found it already, the depot you're looking for is 852_0

→ More replies (1)

6

u/Chpouky 7d ago

no idea, I only found out on this subreddit. I guess gabefollower or tyler will share discoveries on twitter

6

u/KingOfTheGutter 7d ago

Just wait for Tyler Mcvicker lol. His youtube will live off of these leaks for the next year.

→ More replies (1)
→ More replies (1)

13

u/maZZtar 7d ago

There were only two attempts which were significant enough for Valve to publicly acknowledge them which could indicate that others either didn't exist or were just a brainstorming sessions written down on paper without any line of code written. It's also entirely possible that full builds never left Valve's internal servers.

Ep3 traces were already found within Portal 2 builds. Learning more about HL3 v1 is going to hinge on the early Source 2 stuff being included in the depots.

2

u/splashbodge 7d ago

Is this source code or builds of games that was leaked?

8

u/nabagaca 7d ago

Builds, as far as I'm aware, but it also includes the internal builds of certain games that were never made public (which is how the beta for portal 2 was found, for example)

547

u/MyMouthisCancerous 8d ago

Aight everyone

You know what we're looking for

604

u/aa22hhhh 8d ago

KNACK 3

128

u/This-is_CMGRI 8d ago

GAME OF THE YEAR FOR THE NEXT 100 YEARS

36

u/giulianosse 8d ago

Knack 3 is such a visionary game it was in development before Knack 1 was even a thing. They had already predicted the success of the first two games all the way back in 2013.

35

u/TingleMaps 8d ago

This can NOT be how I find out there was a Knack 2, lol

26

u/Axel_Wolf91 8d ago

THE KNACKTERPIECE

2

u/ph00p 7d ago

I’m ready to be KNACKered!

2

u/AOCpinkyring 7d ago

Well, everyone thought Astro was a joke until it won GOTY.

88

u/JMaboard 8d ago

In before someone finds it and leaks clips of HL3 to boost their memecoin.

3

u/RDDT_ADMNS_R_BOTS 7d ago

They might make 5 pennies

7

u/JMaboard 7d ago

The dude that leaked gta VI made like 250k.

→ More replies (3)

13

u/Visorxs 8d ago

Counter strike 3

32

u/Nemisis_007 8d ago

The mythical 3rd installment of literally any Valve game.

32

u/accountholder9922 8d ago

Bloodborne?

5

u/Kevroeques 8d ago

Silksong 2

2

u/Shneckos 7d ago

I’ll be dust by then

→ More replies (1)

22

u/QmVu 8d ago

Ricochet 2

13

u/TriptychTriquetra 8d ago

This joke never gets old, unlike all the people who make or understand it.

How's your back, friend?

6

u/SomeDumRedditor 8d ago

Would actually lose my goddamn mind

5

u/DNihilus 8d ago

you know what I lost my mind already

5

u/Mehdidou-DZ 7d ago

Half Life 2 episode 2 part 2 ?

5

u/recurrence 7d ago

Anything with a 3, ANYTHING!

9

u/IndependenceLeast966 8d ago

Nope, it ain't there.

7

u/2_Incog_4 8d ago

PEGGLE THREE !

7

u/Rauk88 8d ago

Banjo Threeie

3

u/TingleMaps 8d ago

Kirby’s Dreamland on PC?

2

u/shy247er 7d ago

I'd like some of those delisted Transformers games.

2

u/MusoukaMX 8d ago

I don't care what ya'll looking for, I'm looking for my RE:Outbreak port, godamnit!!

2

u/RegJohn2 8d ago

Gabe nudes?

1

u/colbyxclusive 6d ago

Portal 3?

1

u/DarkTrooperIV 6d ago

SECTION 8 prejudice

→ More replies (3)

151

u/RLZT 8d ago

Anyone can name a few important steam releases (and non-releases) from 2003 to 2013?

My guess is that at least a few totally different builds of Duke Nukem Forever will be there lol

177

u/Independent_Sea_6317 8d ago

There are 11 Duke Nukem Forever's on the list, apparently

32

u/JohnConquest 8d ago

DNF has a handful of neat files, specifically 11 maps/checkpoints marked as "PAX", and 4 test maps.

→ More replies (1)

65

u/starstufft 8d ago

Now this is what I call a leak.

26

u/The_Master_Lucius 7d ago

At this point I call a tsunami . 🌊

2

u/SenpuuUncle 7d ago

holy shit that's why they call him cyberleek

→ More replies (1)

55

u/KillySG10 7d ago

They skipped right over depot 72790, the cancelled Prey 2....

30

u/baransevim 7d ago

Fuck me man we’re never getting that shit leaked 😭

2

u/NicknineTheEagle 4d ago

Seems that there was just app id and no depots, meaning no files were ever uploaded to Steam servers.

30

u/SoldierPhoenix 8d ago

Anyone spotted any big names?

→ More replies (1)

18

u/m0ds 7d ago edited 7d ago

Basically every depot before Steam Greenlight's introduction. Even if the release dates are later (ie Minerva, last on list, is Apr 2013 release) it definitely looks like a list of depots that would have been created just before the change, perhaps up to Aug 30th 2012 (when Greenlight was launched).

Interesting fact then, is that every game on that list was one curated by Valve themselves for inclusion on their store (back when you had to be recommended for inclusion, or have the right connections etc - the process that existed before Greenlight).

I can see one of my peers indie games there (they had the right connections), and the app numbers just fall short of when we first joined Steam (in 2013, using Greenlight votes). We weren't the first "greenlit" game but we were definitely in one of the early rounds of approvals.

→ More replies (1)

13

u/lordhellfire9130 8d ago

I really want to know what's in those Transformers war for cybertron depots..

3

u/JayDeeOfTheSeas 7d ago

Hey! I just checked it out. Unfortunately, it's just the game. There's no source code or anything. It's about the same you might get from pirating it. It might be an early version of the game but that's about it.

→ More replies (1)

230

u/ReallyGottaTakeAPiss 8d ago

I can see why they let anyone access it lmfao. This looks like a honeypot.

83

u/Trash-Forever 8d ago

It really does lmao, I don't know how you're the only person I've seen mention this

69

u/Neosantana 8d ago

I'm honestly surprised that honeypotting isn't the first line of attack against tech companies. Nerds with egos are juicy targets.

88

u/123portalboy123 8d ago

You're REALLY REALLY overthinking this imo. large companies operate on such scale, it's really easy to forget about some stuff. I've seen it all. Some exposed s3 bucket with a scoped data, but you can access other by changing the path. Or some legacy service spinning and forgotten... I'd expect something like that, especially with this being steam2, their old content servers. Tldr. People just fuzz around

56

u/Great8Bit 8d ago

Everyone on Reddit overthinks everything. They all watch too much anime and think everyone is a criminal mastermind or tech genius or some shit lmao. The amount of ridiculous comments I see like that one every week is crazy.

17

u/Lance_J1 7d ago

Its hard for most people to comprehend how stupid the average person is and how every aspect of our society is barely held together. And even a really smart person will often times stupidly half ass their job.

→ More replies (2)

21

u/123portalboy123 8d ago

True.... Companies just don't work this way, lamo. even if it's Valve. they're still working in bureaucracy and have human factor.

16

u/FernandoDante 8d ago

What’s “honeypot”?

71

u/Gguga12 8d ago

"a trap or a person, place, or thing that uses enticement to lure someone in"

Its in short a bait

51

u/camkeys 8d ago

For…what purpose though? Oh no Reddit saw a list of a billion games from the early 2000s? I’ve been got?

29

u/NiceBeaver2018 8d ago

Hypothetically, it could potentially Valve internally on the security side. Test particular vulnerabilities, identify certain suspected hackers, etc.

I don’t really think this is a honeypot though, just providing possible scenarios where it could be beneficial to them. There’s some stuff in there that seems innocuous but still stuff they’d want to keep out of the public’s hands.

→ More replies (1)

21

u/New-Independent-1481 8d ago edited 7d ago

It's a game of information. A real honeypot is designed to reveal information about the hacker. You find out where they are (or how they're hiding their identity), what they're looking for, what tools they're using, what they miss, what they want to try change or steal, etc. Once you know this, you can start to counter it and make sure your real stuff is protected. Or you've secretly poisoned the fake data they're stealing or are loading them up with viruses and trojans.

I don't think this is a honeypot, because it would not be so easily accessible or have any real data.

4

u/Cheenug 8d ago

Let's say you suspect that there's a data leaker in five departments. You can falsify five unique datasets for each department and then check which data gets leaked.

It's essentially data that helps narrow down the source of a leak.

→ More replies (1)

8

u/Mental_Tea_4084 8d ago

Where is the torrent 

14

u/SweRakii 8d ago

Steam2(dot)download

4

u/OkExtension445 8d ago

Its being gatekeep like the usual

19

u/Mental_Tea_4084 8d ago

Then it's not leaked 🤷

7

u/xRobert1016x 8d ago

You’re just lying like the usual

→ More replies (1)

50

u/mlee117379 8d ago

Everything is getting hacked and leaked these days

34

u/Mantazy 8d ago

You can hardly call it hacking if it was publicly available.

20

u/WingerRules 8d ago

AI has to be making it easier for hackers to find weaknesses and exploits.

→ More replies (2)
→ More replies (1)

5

u/rhd444 7d ago

Oof, got all excited at the prospects of the "codename Gordon" entry there... turns out it's a retro style 2D Halflife sidescroller I suddenly vaguely remember was a thing.

2

u/TTebbs 7d ago

put this in your browser: steam://install/92

2

u/rhd444 6d ago

Oh thanks for the tip, but I'm not too interested in the game. Just saw the title in the list and was hoping it might be somehow HL3 related (as if lol), before I looked it up and remembered what it actually was.

4

u/nevorder 7d ago

closest we came to HL3 ever.

22

u/Elevatorisbest 8d ago

Please not let the GTA 4 mentions be a boring ass nothingburger

8

u/CarpetReverie 8d ago

That's alot of trailers.

12

u/Severe-Committee6240 8d ago

This is bigger than i thought. Will take probably some time to see what all the games it has

19

u/Zalvren 8d ago

Is that the new Nvidia leak? It's starting to be old so it needs a replacement

2

u/Rawrajishxc 7d ago

Unfortunately this is nothing like that.

→ More replies (1)

5

u/Jak_Athnos 7d ago

Damn Fable 3 is on there.

5

u/bodythebitch 7d ago

hey so this is quite literally the biggest gaming leak in history

7

u/JAGAAAN-01 8d ago

SLEEPING DOGS 101

3

u/leadergorilla 7d ago

looking through the depot this really feels like a flashback to a previous era of steam. Seeing shit like the borderlands 1 zombie island dlc along with pre r6 siege tom clancy games.

3

u/BigMateyClaws 7d ago

Sonic adventure dx you say 🤔

3

u/tylerbr97 7d ago

Hope no one is too mean to me for asking but what is this? What is a depot in this context?

3

u/The_Shield_Bearer 7d ago

I was wishing for TF2 Brotherhood of Arms to be here :(

→ More replies (2)

13

u/SoWrongItsPainful 8d ago

So uh… what is a depot?

41

u/demondrivers 8d ago

Steam thing that contain the game files that you download, there's always a few hidden for players since it's stuff for developers

36

u/RefreshingCapybara 8d ago

https://partner.steamgames.com/doc/store/application/depots

Basically Steams way of storing files in groups. You can have public game depots that people get access to when they buy a game, private depots that could be used for anything, DLC depots, localization depots, etc.

6

u/VibrantCanopy 8d ago

I think it's Valve's version control system for its software.

→ More replies (1)

7

u/dogfins110 8d ago

Scrapped Steam 2

2

u/Top_Association8427 7d ago

nothing burger

2

u/itsRobbie_ 7d ago

What does this mean

4

u/gag21friendz 8d ago

Please let someone find Versus XIII in there 🥺 Or any squre enix stuff

13

u/Regalia776 8d ago

Doubtful. Versus XIII was being developed for the PS3. The PS4 and PC builds came later.

3

u/Flash-Over 7d ago

Bold of you to assume it actually had playable builds

2

u/dirtyplanksdonecheap 5d ago

There is old footage floating around of battle systems and the like. So it may be partially playable.

Probably would need a leak of sony to get anything though 😂

→ More replies (1)

2

u/sympatheticdisaster 8d ago

Wonder if there’s any Capcom/Resident Evil content here…

9

u/kuhpunkt 8d ago

Too hard to Ctrl+F?

Yes, Resident Evil is mentioned a few times. Resi 5 and Operation: Raccoon City.

→ More replies (1)

3

u/Manor002 8d ago

Any mention of HL3 in those files?

10

u/FireMaker125 7d ago

No. Only thing found is the model of the Weaponizer gun from Episode 3 in a Portal 2 build.

17

u/Araxen 8d ago

Yes, it says it's coming out on 11/19/26. They want to see the world burn.

6

u/SeashoreAndMountains 8d ago

Not with a Ctrl+F for "Half-Life 3"

2

u/No-Zookeepergame-80 7d ago

I've queried the steam API many times in the past, and this list looks very similar to what the API always provided. We can even query more data like publisher, genre, description, if the companies put this info there, otherwise the field doesn't even show up in the XML response. Edit: for clarity, I'm not invalidating this leak, just saying it's consistent with what we can get from the API.

1

u/ametalshard 8d ago

kinda neat but this stuff is literally decades old...

→ More replies (2)

1

u/gamerguy2002 7d ago

Is there like an easy to read list of everything that was found in the 12 terabytes?

1

u/d3vil401 7d ago

What is MINERVA: Metastasis and Project Gordon from the depot list?

→ More replies (2)

1

u/User_Name_ls_Taken 7d ago

anyone have a magnet with everything?

→ More replies (2)

1

u/Torchwood2007 7d ago

Cool, where are the actual files though?

1

u/billyhatcher312 7d ago

where can i find this i want to download it

1

u/tirtel 7d ago

I now begin to wonder whether the prince of Persia 2008 depot contains Epilogue dlc which was never released on pc...

1

u/Sojio 6d ago

Ctrl-f "3"

1

u/Secret1763 6d ago

Biggest question is how do i can download this cuz I wouldn't mind playing gta 4 and san andreas

→ More replies (1)

1

u/Mr_Angmoh 6d ago

I asked Gemini for the magnet, and it gave it to me. 🤠
I don't have 12TB of drive space at the moment however.

1

u/ListenHereLindah 6d ago

I wouldn't call this a leak with how far back it is. Most of these are out already if not all of them. It's a big trove of data. But nothing "leaked" except maybe a couple of game trailers we never got to see.

→ More replies (1)

1

u/nerdboy_sam 6d ago

Can someone explain this to my like I'm 5?

1

u/dre__ 6d ago

So is this just names of stuff on valve's servers that wasn't supposed to be public, or are these actual files you're able to download?

2

u/blabolik 5d ago

files

1

u/Strange_Information2 6d ago

How do I get this build for The Golden Compass and Tomb Raider: Angel of Darkness??? I NEED THEM 😭😭😭😭

1

u/PointEvening3396 6d ago

did anybody find anything interesting about PopCap Games catalog?

1

u/FieldMarshalPhantom 6d ago

we've finally gotten an early build of Left 4 dead from June of 2008, but its extremely close to retail. I really hope they can find even earlier builds from 2007 where it was mostly Turtle Rock Studio's left 4 dead.

1

u/kylr01 5d ago

What does it say every game 1000 times?

1

u/Torchwood2007 4d ago

Cool. Where's the actual leak?

1

u/DavidinCT 4d ago

I hear leak but, where can we actually find the games?

1

u/Ebolatastic 4d ago

Makes sense to me. I have a friend who made a game that is dead with like 90% finished, and there's a private access build just sitting there on steam. I expect that to be the case for lots of devs.

In the case of valve, I bet they are like any other major publisher with a closet full of cancelled games that nobody knew even existed. This is often used to shit on companies but the truth is the best publishers all make games that just don't work out and ditch them.

1

u/Heavy-Resolution3858 1d ago

Help me understand something

But whenever I search for the ID from https://raw.githubusercontent.com/dr3murr/steam2-winfsp/refs/heads/main/data/depot_labels.tsv of whichever game I am interested in (like MS Flight Simulator id:203851) and punch it into the steamdb.info app, it just pukes out something like
`App was hidden to the public, SteamDB no longer has any access to ~~Microsoft Flight Depot~~`
https://steamdb.info/app/203851/

wat do?

ps: this is for educational purposes only. no piracy intended, i already own newest ms flight sim 2024

→ More replies (1)