A retired Valve delivery endpoint served up 12TB of pre-2013 game builds

The mechanism behind the leak is ordinary: a retired pipeline that kept answering requests. Steam2 packaged Valve's game content into older formats ^[3], and SteamPipe took over in 2013, which is why the archive's contents stop that year ^[4]. Nothing new went through it after that. According to Gabe Follower, the Valve dataminer who went through the files, everything in the dump was obtained via a publicly accessible endpoint with no hacking involved, and he said the fault is Valve's ^[2].

Twelve terabytes covering 2003 to 2013 averages roughly 1.2TB for every year in the range ^[13]. That is a decade of packaging output rather than one product's leftovers, spanning playable Portal 2 builds dated July 2009 ^[5] and a CS:GO that was still a heavily modified Counter-Strike: Source ^[6]. An archive that size accrues across staff generations, which is exactly the condition under which a host quietly loses its owner.

A decommissioned service that takes no writes is often assumed to be out of scope for a security review; this one kept answering reads, and everything on it was historical anyway. Old builds persist rather than decay. The F-Stop assets from a scrapped Portal prequel ^[7] and the Weaponizer models tied to the canceled Episode 3 ^[8] matter more to researchers now than when they were current work, which is why the dump set off a wave of community archaeology ^[12].

The detail that moves this out of gaming trivia is the third-party content: early builds and beta material for Sonic 4 Episode II and Fallout: New Vegas were identified inside ^[9]. Those publishers did not run the endpoint and did not pick its retirement date. If other companies ship through your pipeline, their unreleased work is sitting in your retired systems, and their loss will never appear on your incident log.

Two things remain unresolved. Valve has not issued a public statement about the exposure ^[10], and dataminers are still separating genuine finds from duplicated code and placeholder assets ^[11], so the inventory of what escaped is not settled. The account of how it escaped rests on Follower's word as reported by Dexerto ^[2].

One simple test separates the systems that need attention from those that do not. First axis: does the system still accept writes? Second axis: does it still answer reads from the public internet? Write/read is watched, because it is the product. Neither is genuinely dead weight, and can be treated as such. No-write/read is where a decade of intellectual property sits with no owner and no alerting. For each system your team has in that cell, name the person who would notice a request against it tomorrow. When the honest answer is a dataminer, the endpoint already has a value to someone outside the company.