The Steam Teraleak: 12TB of Internal Game Builds from 2003–2013 Are Now Public

What Happened

On August 29, 2026, researchers discovered that Valve's old storage server — the one used to host Steam content from the platform's founding in 2003 until Valve migrated to a newer system in 2013 — was still publicly accessible. No passwords. No access controls. Just thirteen years of internal game builds sitting on an open directory, available to anyone who found it.

What followed became known as the Steam Teraleak: a 12–13 terabyte download encompassing every game uploaded to Steam during that decade, including unreleased betas, internal test builds, and developer assets never intended for public eyes.

• ▶Sources: Polygon — Steam Just Suffered the Biggest Leak in Video Game History · VGC — More than 12 TB of Steam games and unreleased betas from 2003-2013 have reportedly leaked

Timeline

What's in the Leak: Valve's Own Games

The most documented findings so far are from Valve's own franchises.

The Portal 2 Finds

Portal 2 shipped in 2011 as one of the most critically acclaimed puzzle games ever made. The leaked builds reveal it once had a bullet-time mechanic — time slowing while players solve environmental puzzles — that was entirely removed before release. Even more striking is a Cave Johnson voice line about Companion Cubes that fans believe confirms theories about what Companion Cubes actually are within the Portal universe. Whether or not that interpretation holds up to scrutiny, the existence of the line itself has electrified the community.

Half-Life 2: Episode 3 — A 20-Year Mystery, Partially Resolved

Announced by Valve in 2006 and never released, Half-Life 2: Episode 3 has been one of gaming's most persistent mysteries. The leaked data contains asset strings and media referencing an ice gun and a Weaponizer — objects Valve itself briefly mentioned in the Half-Life 2 20th anniversary documentary in 2024. The Artic setting and ice-based gameplay, long rumored in developer accounts, appears to have genuine material evidence now. The scale of what was actually built remains unclear; more discoveries are expected in the coming days.

F-Stop: The Valve Game That Felt Like a Rumor

F-Stop has been discussed in Valve circles for over a decade. A camera-centric puzzle game set in the Portal universe, it was reportedly developed and then cancelled without any public announcement. The Steam Teraleak contains what researchers describe as a full build — not just concept art or strings, but a playable-era prototype. For fans who had started to treat F-Stop as an urban legend, this is a significant moment.

What's in the Leak: Third-Party Publishers

The leak is not limited to Valve. Every game uploaded to Steam between 2003 and 2013 is reportedly in the dataset.

X user Aesthetic Gamer (formerly DuskGolem), a Resident Evil series insider, noted the dataset includes "third party games like Sonic 4, a ton of indie games, etc." and added: "It's very recent, over a dozen terabytes in size, a lot to sort through, and this whole situation is going to probably get really messy very quickly."

A publicly available depot label list on GitHub names every item in the leak — providing a searchable index of what was exposed before researchers have even finished downloading.

How It Happened: Not a Hack

Valve tracking account Scolcer was among the first to clarify the mechanism:

“

"There has been no hacking. This is 100% Valve's fault. The Steam Teraleak was obtained from a site that was 100% accessible to the public. It was there for everyone to download. No passwords. Nothing. Hidden in plain sight, but with no protection whatsoever. This is the reason it only covers from Steam's birth up to 2013, when they switched to the new storage system." — Scolcer (X, August 29, 2026, translated)

The explanation is straightforward: when Valve migrated to a new storage infrastructure in 2013, it left the old server running without restricting public access. The directory sat open for thirteen years until someone found it. Downloading the contents required no credentials, no exploits, and no social engineering — just knowing where to look.

Positions and Responses

Community Response

Response across the gaming community splits cleanly along two lines.

For fans of Valve's franchises — particularly Portal and Half-Life — the leak is generating genuine excitement. The Portal 2 bullet-time footage and the Cave Johnson Companion Cube line are being parsed closely for what they reveal about development decisions. The F-Stop build confirmation has re-ignited discussion about whether Valve should revisit the concept. The Half-Life 2: Episode 3 material, however limited, is carrying a weight that goes beyond curiosity.

The concern side of the ledger is harder to dismiss. The data includes unpublished work product from publishers who had no say in its exposure. Depending on what's in the builds for specific studios, this could surface trade secrets, unreleased narrative content, early versions of shipped games that studios may not want compared to final products, or — in a worst case — personally identifiable data from QA testers whose names or accounts appeared in internal builds.

Researchers and community members are already flagging that downloading or distributing the leaked files carries real legal risk under copyright law in most jurisdictions. The dataset is the kind of thing that is easier to read about than to be in possession of.

What This Means for the Industry

Valve's situation illustrates a risk that is easy to overlook: legacy infrastructure. The storage system that caused this leak was not maintained or monitored — it was simply abandoned. The files it held were Valve's oldest, from an era when the company was smaller, the platform was younger, and security standards were different. In retrospect, migrating to a new system in 2013 without auditing what remained on the old one was a significant oversight for a company of Valve's scale.

The broader implication for publishers: any game whose internal builds were hosted on Steam during that decade is potentially in the dataset. The full scope of what was exposed is still being mapped by community researchers, and it is safe to assume affected parties are quietly assessing their exposure.

Quick Summary

Valve has built some of PC gaming's most beloved franchises. The Steam Teraleak is a reminder that even the most trusted platform operators can leave serious gaps — and that gaps left unattended for thirteen years eventually get found.