Internet Archive Data Breach

In October 2024, the Internet Archive suffered a data breach exposing the email addresses, usernames, and bcrypt-hashed passwords of 31 million users. The breach was accompanied by a website defacement and separate DDoS attacks that took the Wayback Machine offline.

What Happened

On October 9, 2024, visitors to the Internet Archive's website were greeted with a JavaScript popup message indicating the site had been breached. The attacker exploited a GitLab configuration file exposed on one of the Archive's servers, which contained an authentication token. This token allowed the attacker to download the Internet Archive's source code and access the user database. The stolen database, dated September 28, 2024, was provided to the Have I Been Pwned service. Separately, the Internet Archive also faced DDoS attacks and pro-Palestinian hacktivist group SN_BlackMeta claimed responsibility for the DDoS component.

What Data Was Exposed

Who Is Affected

Approximately 31 million users who created accounts on the Internet Archive (archive.org) were affected. This includes users of the Wayback Machine, Open Library, and other Internet Archive services that required account creation.

How to Check If You Were Affected

The breach data was provided to HaveIBeenPwned.com, where you can check if your email was included. If you had an Internet Archive account created before September 28, 2024, your data was likely exposed. The Internet Archive also sent notifications to affected users.

What You Should Do Now

• Change your Internet Archive password immediately
• Change passwords on any other accounts where you used the same credentials
• Enable two-factor authentication on your Internet Archive account when available
• Use a password manager to create unique passwords for each service
• Be cautious of phishing emails referencing the Internet Archive

Last updated: February 10, 2026