By ByteBot
On August 30, 2026, a 12TB archive of Valve game files from 2003–2013 surfaced online — but nobody hacked anything. The data was sitting on a completely unauthenticated, publicly accessible endpoint left over from Valve’s old Steam2 content-delivery system. No password. No credentials required. Archive crawlers found the URL, and the files were simply there. Data miner Gabe Follower confirmed it directly: “The Steam Teraleak was obtained from a site that was 100% accessible to the public with no passwords and nothing.” This is the Steam2 Teraleak, and it’s one of the largest unintentional data exposures in gaming history.
Not a Hack — A Forgotten Server
Valve’s Steam2 was the content delivery infrastructure that powered Steam before March 2013. It used proprietary protocols and Game Cache Files (GCF) for packaging, and updates required Valve to manually push each release on developers’ behalf. In 2013, Valve migrated to SteamPipe — an HTTP-based CDN using VPK packaging, where developers could self-publish updates. The old Steam2 endpoints were supposed to be retired. Critically, they weren’t locked down.
The result: a publicly reachable server sat with no authentication for 13 years. There was no breach, no sophisticated attack, no credential stuffing. Someone found the URL, and the entire Steam2 depot archive — 12TB of game development history — was right there. According to Hardware Busters’ analysis of the incident, the situation “was 100% Valve’s fault” — and that framing matters, because it changes how we think about this incident.
Related: Omarchy’s Docker Group Gave Every Process Root for 14 Months — another long-running misconfiguration hiding in plain sight.
What 13 Years of Steam History Looks Like
The archive spans 2003–2013, and it’s not just Valve’s own games. For Valve’s titles: a July 2009 Portal 2 build using Team Fortress 2 placeholder assets, assets from F-Stop (the abandoned Portal prequel that used a camera mechanic instead of a portal gun — a direction Valve nearly took before scrapping it), early Counter-Strike: Global Offensive builds based on modified CS:Source, and Left 4 Dead prototypes. Meanwhile, a Weaponizer 3D model previously linked to the canceled Half-Life 2: Episode 3 also surfaced, though researchers note Valve reused this model in Portal 2, so it’s not confirmation of an Episode 3 build.
Furthermore, the third-party scope is what makes this genuinely alarming. PC Gamer called it “one of if not the biggest leaks to occur.” The archive contains pre-release builds from dozens of publishers that shipped on Steam before 2013: GTA 3 and Mafia 2, Batman: Arkham Asylum, Dragon Age: Origins, Fallout: New Vegas, Sonic 4: Episode II, Spore, and Spec Ops: The Line. Moreover, these weren’t Valve’s files to lose. Publishers submitted their builds to Valve as part of Steam onboarding, and Valve stored them on a server with no access controls.
The Lesson Every Developer Team Should Read
Consequently, this is not a Valve-specific problem. Old infrastructure is not automatically safe infrastructure. When you migrate platforms — CDN providers, storage backends, build artifact hosts, CI/CD systems — the old system doesn’t disappear. It keeps running until you explicitly shut it down. Valve apparently didn’t. The Steam2 endpoints kept serving data for 13 years after the SteamPipe migration because nobody decommissioned them.
Additionally, the danger compounds quickly. Pre-release builds aren’t just old code. They contain licensed middleware, third-party SDKs under NDA, signing keys baked into build scripts, partner assets, and proprietary tooling. As Ars Technica reported, observers flagged the third-party content as “a dramatically more dangerous situation than if it were just some Valve builds.” Any team that has ever migrated storage providers should be asking right now: did we lock down the old system, or did we just stop using it?
Practical checklist for any migration:
- Audit every endpoint and CDN route before completing migration — don’t just reroute traffic, decommission the old system
- Require explicit sign-off that old storage has been access-controlled or destroyed
- Rotate any credentials that may be embedded in old build artifacts
- Notify partners whose content you stored if there is any exposure risk
Valve Has Said Nothing
As of publication, Valve has not responded. Former Valve developer Elan Ruskin offered a wry deflection on social media: “Every good idea we had went into the final thing we shipped, and anything not in the final version was not a good idea.” The legal picture is murky — accessing a public URL is not unauthorized access under most definitions, but the content remains copyrighted. Third-party publishers like Rockstar and 2K have the strongest potential claims and have also stayed silent. The archive is being catalogued. The legal standoff is just beginning.
Key Takeaways
- The Steam2 Teraleak was not a hack — Valve’s old CDN infrastructure sat open on a public URL with no authentication for 13 years after the 2013 SteamPipe migration
- The archive contains 12TB of game builds from 2003–2013, including F-Stop (Portal’s scrapped predecessor), early CS:GO builds, and pre-release titles from Rockstar, BioWare, Eidos, SEGA, and many more
- Third-party exposure makes this legally significant — publishers had no say in how Valve stored or secured their builds
- The developer lesson: decommission old infrastructure explicitly; migrating to a new system doesn’t mean the old one is gone
- Valve has not responded; the legal and preservation debate is ongoing
Thirteen years. No password. That’s all it took.
