12 Terabytes of Old Steam Data Leaked From an Unsecured Valve Server, Not a Hack

A massive trove of old Steam data, somewhere between 12 and 13 terabytes, has leaked online. It contains internal builds and finished releases uploaded to Steam between 2003 and 2013, according to a report the community is calling the "Steam Terraleak" or "Steam2 Teraleak."

This wasn't a break-in. According to the X user who first flagged it, known as Gabe Follower, the data came from a publicly accessible endpoint tied to Valve's retired Steam2 infrastructure, the system Valve used before switching to its current HTTP-based SteamPipe platform around March 2013, according to Tom's Hardware. NotebookCheck reports that the files sat on an incorrectly exposed server with no login required.

YouTuber Scolcer put it bluntly in a post cited by GamesRadar: "There has been no hacking. This is 100% Valve's fault. The Steam Teraleak was obtained from a site that was 100% accessible to the public. It was there for everyone to download. No passwords. Nothing. Hidden in plain sight, but with no protection whatsoever."

Leaving over a decade of proprietary game-development data sitting on the open internet with zero access controls is a serious security failure, regardless of whether a hacker had to work for it.

What's actually in it

The biggest single target so far is Portal 2. Data miners reconstructed a playable beta dating to July 2009, when the game was still built around a scrapped "Core Hub" concept rather than the direct sequel Valve eventually shipped, according to Tom's Hardware. That build uses placeholder assets borrowed from Team Fortress 2 and the original Half-Life, features a different and more passive GLaDOS with unused voice lines, and includes a bullet-time mechanic that slowed down mid-air movement before it was cut, per GamesRadar.

Also buried in the Portal 2 files: a full build of F-Stop, an unreleased Valve prototype set in the Portal universe that replaced portals entirely with a camera that could photograph objects and place them back into the world at different sizes, according to NotebookCheck and Engadget.

Left 4 Dead files include a runnable build from June 2008 with a different HUD, cut voice lines, an entirely different rooftop layout for the No Mercy campaign's finale, and assets recycled from an old Counter-Strike: Condition Zero mod called Terror Strike, according to Tom's Hardware. Early Counter-Strike: Global Offensive prototypes look almost identical to Counter-Strike: Source, complete with blockout versions of the Baggage and Safehouse maps and a scrapped mode where terrorists escorted a moving tank, per NotebookCheck.

The Half-Life 2: Episode 3 reality check

The headline-grabbing find is a 3D model for a weapon called the "Weaponizer," originally built for the long-canceled Half-Life 2: Episode 3. Valve reportedly recycled the unused asset as a placeholder while building Portal 2's early levels, according to Tom's Hardware and NotebookCheck.

That's it. There is no playable Episode 3 build, no script, no level in this leak. Engadget was careful to note the connection to Episode 3 is still just a reference inside other files and cautioned readers to "take all this info with a grain of salt" since Valve hasn't confirmed anything. GamesRadar echoed that caution directly, telling readers "don't get too excited about the prospect of Half-Life 3 news just yet" given how much of the 12TB archive remains uncombed.

Third-party games caught in the crossfire

Because the leaked server hosted Steam's entire content pipeline for a decade, it wasn't just Valve's own games exposed. Early builds and cut content tied to Call of Duty, Resident Evil, Mirror's Edge, Batman: Arkham Asylum, Dragon Age: Origins, Alan Wake, Sonic 4, and Fallout: New Vegas have all surfaced, according to The Verge and GamesRadar. None of those studios have issued statements addressing the exposure of their old development files.

What's unresolved

Valve had not publicly commented on the leak as of Engadget's reporting. With 12 to 13 terabytes of data, community catalogers, including a GitHub-hosted index cited by Engadget, are still working through what's there. Whether Valve will confirm, deny, or address the security lapse that put a decade of its own and other studios' unreleased work in public hands remains an open question.