13 TB of Steam Archives Left Publicly Accessible: Early Valve Game Builds, Dragon Age: Origins and Batman: Arkham Asylum

Roughly 13 TB of data from Steam's old server infrastructure has ended up publicly accessible — files uploaded to the platform between 2003 and 2013. According to those who obtained the trove, there was no hack: the data was viewed after a request to a publicly available endpoint. Based on the information available, the incident took place last week; it was reported by Kotaku.

The community has dubbed the leak the “Steam2 leak,” after the former name of Steam's server architecture, which was replaced by the SteamPipes system in 2013. The platform's owner, Valve, has not yet commented publicly on the incident.

The dump holds more than just Valve's games

According to the descriptions available, the trove includes early versions and screenshots of Valve's own projects: Left 4 Dead 2, Portal 2 and the never-released Half-Life 2: Episode 3. Materials like these offer a glimpse of the early stages of these games' development.

The contents of the archive are not limited to the platform owner's games. Beta builds of Dragon Age: Origins by BioWare and EA, as well as Batman: Arkham Asylum by Rocksteady and WB Games, are reported to have been found in the dump — that is, working materials from third-party publishers whose games were distributed through Steam.

This raises security questions for the companies whose data has been exposed. How much sensitive material from third-party publishers ended up in the leak, and what the consequences of its publication will be, is unclear at this point.

Those who found it say there was no hack

Screenshots of the contents were posted on X by a user going by the name Gabe Follower, who claims to have confirmed that there was no hack: the materials were viewed after a request to a publicly available endpoint. Exactly which endpoint is meant has not been specified.

There is another version of events as well. Sources speaking to Ars Technica allow for the possibility that the leak did not occur on Valve's side but on the side of third-party servers holding data collected in earlier leaks. In that case it would be a compromise of a third-party store of previously collected archives rather than a configuration error at the platform itself.

Why old infrastructure resurfaces years later

The story looks like a symptom of a broader problem rather than a one-off slip. Infrastructure decommissioned more than a decade ago is rarely deleted completely: it is disconnected from production, but the data stays on servers that nobody audits, because formally they are no longer needed. The larger and older the platform, the more blind spots of this kind it has — and the higher the chance that one day an open route to them will turn up.

The second factor is a matured digital archaeology community. For years, enthusiasts have been systematically scanning and cataloguing the remnants of old gaming services, and any accessible fragment of such an archive quickly spreads through copies, after which removing it from the internet is no longer possible. For studios this reframes the task: internal materials have to be deleted at the moment a project is shut down, not when someone remembers them.

For artists, designers, modellers and programmers, archives like these are valuable as study material: intermediate builds show how levels, models and mechanics changed between iterations. But the legal status of such materials does not change with their age: they are still the publishers' intellectual property, and publishing cut content, screenshots or assets from a leak remains a risk for whoever distributes it.

If the trend holds, publishers will likely become more careful about handing builds over to third-party platforms and about how long partners retain distributables, while the platforms themselves will pay more attention to taking inventory of legacy systems. The immediate practical question about this leak is how much third-party publisher material ended up in it; there are no public estimates yet.

Will Valve manage to close the endpoint before the 13 TB spread across mirrors?