31 million accounts affected as Internet Archive gets hacked; site defaced and DDoS'd

Update 21/10/24 10:54 am (IST): The Verge reports that hackers still have access to the organization’s internal emailing tools and have been using them to reply to user support tickets. These replies mock the Internet Archive’s security practices and claim that hackers have access to user data submitted through those tickets.

The Internet Archive is slowly recovering from the attack and has brought some services back online, but a significant portion of its data archive remains inaccessible. The reason for the attack is still unknown.

Original article published on October 10, 2024, follows:

Update 15/10/24 10:54 am (IST): After going dark for a few days, Internet Archive’s Wayback Machine is now functional again. The founder says the ‘Save Page Now’ feature isn’t available yet, and there might still be further maintenance which would lead to suspension of the service again.

Original article published on October 10, 2024, follows:

The Internet Archive has suffered a significant breach impacting 31 million accounts. On Wednesday, visitors to the site were met with a pop-up alert announcing a “catastrophic security breach,” which was later confirmed by Internet Archive founder Brewster Kahle. The website was also defaced and subjected to a distributed denial-of-service (DDoS) attack, which has caused disruptions for days.

The pop-up message, loaded through a compromised JavaScript library, read: “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”

“HIBP” refers to Have I Been Pwned?, a service where users can check if their data has been exposed in a breach. The operator of HIBP, Troy Hunt, confirmed to BleepingComputer that he received a file containing the email addresses, screen names, password change timestamps, Bcrypt-hashed passwords, and other data of 31 million unique users. Hunt verified the data’s authenticity through multiple sources.

The breach has left the Internet Archive scrambling to address the attack. Kahle posted on X, confirming the breach and explaining that the team had disabled the compromised JavaScript library and is working on improving security measures. The DDoS attack, which had been ongoing for days, has also complicated the recovery process.

According to archivist Jason Scott, there were no clear demands from the attackers, who appeared to be acting simply “because they can.”

A group claiming responsibility, BlackMeta, hinted at further attacks to follow, escalating concerns over the site’s future stability. The attack is particularly alarming given the scale of data compromised, and many affected users are awaiting further updates.

As the Internet Archive works to bring its services back online, you should consider monitoring your account on Have I Been Pwned to check if your information has been exposed.