Internet Archive (Archive.Org) Hacked: 31 Million Accounts Compromised

Internet Archive suffered a massive cyberattack, leading to a data breach where 31 million user records were stolen and shared on HaveIBeenPwned (HIBP).

The internet’s historical treasure trove, the Internet Archive, has been hit by a devastating cyberattack leading to a data breach, compromising the personal information of 31 million users. The attack unfolded dramatically: Visitors to archive.org were greeted by a pop-up message, seemingly from the hackers themselves. It read:

“Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”

This cryptic message hinted at the severity of the situation. Troy Hunt, founder of HaveIbeenPwned (HIBP), revealed that a hacker shared a 6.4GB database with him, containing authentication information for registered members.

Screenshot from Archive.org displaying the message left by hackers

For your information, HIBP, short for “Have I Been Pwned,” is a website that allows users to check if their email addresses have been leaked in data breaches.

According to Troy, the 6.4GB database contains user information, including email addresses, usernames, timestamps of password changes (with the most recent being September 28th), and even encrypted passwords.

The attack went beyond data theft. The Internet Archive also faced a Distributed Denial-of-Service Attack (DDoS Attack), overwhelming the website with traffic and making it inaccessible to users.

A pro-Palestinian hacktivist group DarkMeta claimed responsibility for the DDoS attack in a post on X, citing the Archive’s supposed affiliation with the US government as the reason. However, the Internet Archive is a non-profit organization founded by Brewster Kahle (co-founder of Wayback Machine) and the site has no affiliation with the government.

On their X (Twitter) account, Kehle confirmed DDoS attacks on the website. In a tweet at 2:08 AM, Oct 10, 2024, Kehle said they mitigated a DDoS attack. However, in a tweet sent out just 3 hours ago at 11:36 AM, Oct 10, 2024, Kehle revealed they are facing more DDoS attacks and the website Archive.org and Openlibrary.org, an online project intended to create “one web page for every book ever published” have been offline.

At the time of writing both sites were offline. Nevertheless, the full picture of the attack remains unclear as it is a developing story. While the DDoS attack and data breach seem coordinated, the connection is not definitive.

Jake Moore, Global Cybersecurity Advisor, ESET weighed in on the situation, highlighting the broader implications of the breach.“Hacking the past is usually technically impossible but this data breach is the closest we may ever come to it.”

“The stolen dataset includes personal information but at least the stolen passwords are encrypted, however, it’s a good reminder to make sure all your passwords are unique as even encrypted passwords can be cross-references against previous uses of it,” Jake explained.

“Have I Been Pwned is a fantastic free service that can be used after a breach. It securely contains millions of breached usernames and passwords for people to safely check their credentials against the database to check if they have ever been caught up in a breach.” “If you find your data in any known breaches, it would be a good idea to change those passwords and implement multi-factor authentication,” he advised.

Stay tuned, this article will be updated accordingly.

1. DDoS Attacks Hit France Over Telegram’s Pavel Durov Arrest
2. Archive of Our Own Website Suffering Massive DDoS Attacks
3. Panamorfi DDoS Attack Exploits Misconfigured Jupyter Notebooks
4. Misconfigured AWS bucket exposed 421GB of Artwork Archive data
5. Examining the US Government’s DDoS Protection Guidance Update