Internet Archive data breach (2024)

In late September 2024, attackers stole the authentication database of the Internet Archive — the non-profit digital library best known for the Wayback Machine — exposing roughly 31 million user records. The data theft was followed days later by a public website defacement and a sustained wave of DDoS attacks, turning a single incident into a multi-front crisis.

What happened

The stolen data was packaged as a 6.4 GB SQL file named ia_users.sql, containing email addresses, screen names, password-change timestamps, bcrypt-hashed passwords, and other internal account data. The most recent record carried a timestamp of 28 September 2024, the presumed exfiltration date. A copy was sent to Have I Been Pwned creator Troy Hunt on 30 September for verification.

The breach became public on 9 October 2024, when visitors to archive.org were greeted by a JavaScript pop-up reading: "Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!" The defacement was delivered through a compromised JavaScript library on the site.

Reporting indicated the initial compromise stemmed from authentication tokens left exposed in the organisation's GitLab configuration for an extended period, which attackers used to reach source code and, ultimately, user data.

The DDoS dimension

Separately, on 8 October 2024, the hacktivist group SN_BlackMeta launched a distributed denial-of-service attack against archive.org, knocking it offline repeatedly and announcing further waves. The DDoS appears to have been opportunistic and distinct from the data theft, but the overlapping timing amplified the disruption and the public perception of a coordinated assault.

Impact

• 31,081,179 unique records with bcrypt-hashed passwords — a strong, slow hashing algorithm that significantly limits mass password cracking.
• The Wayback Machine and other services were intermittently offline for days during recovery.
• The Internet Archive rotated credentials, disabled the compromised JavaScript, and upgraded its security posture before restoring services.

Why it matters

The incident is a cautionary tale about secrets hygiene: long-lived access tokens left in a source-control system gave attackers a foothold into a beloved public-interest institution. It also illustrates how a resource-constrained non-profit can face the same advanced threats as commercial targets while lacking comparable defensive budgets. The use of bcrypt for password storage was a genuine bright spot, sharply limiting downstream credential-stuffing risk compared with breaches that relied on weak hashing.