Internet Archive Breach Exposes 31 Million Users’ Data

The Internet Archive, a digital library hosting billions of archived web pages and other media, has suffered a significant security breach that exposed the personal data of more than 31 million registered users, forcing the nonprofit to temporarily shut down its services.

While the organization has confirmed its vast collection of archival material remains intact, the breach represents one of the largest recent attacks on a major cultural institution and comes amid a troubling rise in cyberattacks targeting libraries worldwide.

User Authentication Database Compromised

The breach first became apparent on October 9 when visitors to archive.org reported seeing a JavaScript alert declaring, “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened,” according to BleepingComputer.

Troy Hunt, administrator of the data breach notification service Have I Been Pwned, confirmed that the hackers shared a 6.4GB database with his service containing authentication information for registered members, including email addresses, screen names, password change timestamps, and Bcrypt-hashed passwords.

The most recent timestamp on the stolen records was September 28, 2024, likely indicating when the database was initially compromised, with evidence suggesting the attack came through the archive’s Zendesk email support system.

Services Gradually Returning After Shutdown

Following the breach, the Internet Archive took the unprecedented step of temporarily shutting down its entire site to “access and improve our security,” as reported by NPR.

By the end of last week, the organization had restored several key services including the Wayback Machine—its tool for accessing archived versions of websites—while other services remained in read-only mode as the recovery process continued.

“We’re taking a cautious, deliberate approach to rebuild and strengthen our defenses. Our priority is ensuring the Internet Archive comes online stronger and more secure,” said Internet Archive founder Brewster Kahle in a blog post addressing the situation.

Part of Broader Attack Pattern on Cultural Institutions

This security incident is not an isolated event but part of a troubling trend of cyberattacks targeting libraries and cultural institutions, with Kahle noting similar recent attacks on the British Library, Seattle Public Library, Toronto Public Library, and Calgary Public Library.

The Internet Archive itself had experienced its first attack in its 28-year history earlier this year in May, according to SecurityWeek, with intermittent outages following in subsequent months.

The organization, which operates on a relatively modest budget of approximately $28 million annually—less than a fifth of the San Francisco Public Library’s budget—now faces the considerable challenge of strengthening its security infrastructure while maintaining its mission of universal access to knowledge.

Impact on Affected Users

Security experts recommend that affected users take immediate action to protect their accounts, starting with changing their Internet Archive passwords and any other accounts where they may have used the same credentials.

Although financial information and highly sensitive personal details were reportedly not affected by the breach, the exposed data could still have serious consequences for users if leveraged by threat actors for phishing attempts or other malicious activities.

Users can check if their information was compromised by visiting the Have I Been Pwned website, which now includes the leaked Internet Archive data in its searchable database of breached accounts.

Recovery and Future Security Measures

As recovery efforts continue, Internet Archive staff are working around the clock to restore remaining services while implementing enhanced security measures to prevent future attacks.

The organization has disabled the compromised JavaScript library, conducted system security reviews, and is upgrading its overall security posture as part of what Kahle described as a “cautious, deliberate approach” to rebuilding the archive’s technological infrastructure.

This incident highlights the vulnerabilities faced by nonprofit digital preservation organizations that operate with limited resources while serving as crucial guardians of our collective digital heritage.