The Internet Archive data breach exposed about 31 million user records, according to Have I Been Pwned. The stolen database held email addresses, usernames and bcrypt password hashes. The most recent record is dated 28 September 2024, and the breach became public on 9 October 2024 after a JavaScript alert appeared on the site.
What happened in the Internet Archive data breach?
A recent cyber attack has resulted in a significant data breach at the Internet Archive, impacting 31 million users. The breach was made public after a JavaScript alert appeared on the website, confirming the compromise of the site’s authentication database. The stolen database includes sensitive user information such as email addresses, bcrypt-hashed passwords, and other internal data. The timestamp of the most recent records suggests that the breach occurred in late September 2024.
Who confirmed the breach?
Confirmation of the breach was provided by cybersecurity researcher Troy Hunt, who indicated that the compromised data has already been shared with the Have I Been Pwned (HIBP) service. Hunt also stated that the 6.4GB SQL file containing the stolen data was shared with him nine days prior to the public disclosure. When this post was first written, the Internet Archive had not yet responded to Hunt’s disclosure attempt, which came three days before the data was loaded into HIBP.
Was there a DDoS attack as well?
Additionally, the Internet Archive experienced a Distributed Denial of Service (DDoS) attack, claimed by the hacktivist group BlackMeta, who announced further planned attacks. The extent of the damage caused by this breach and whether any additional data was compromised remain unclear.
What does Have I Been Pwned say about the data?
The Have I Been Pwned entry states that in September 2024 the breach exposed 31 million records. The exposed fields are email addresses, usernames and bcrypt password hashes. Bcrypt is a slow hashing method, which makes mass password guessing expensive, but it does not protect weak or reused passwords for long. HIBP therefore advises people to change the password on every account where they used the same credentials.
What are the risks for affected users?
A list of working email addresses and usernames from a trusted service is useful for phishing, because a message that mentions the Internet Archive looks plausible. Anyone who reused the Archive password elsewhere is exposed to credential stuffing, where attackers try the same email and password pair on other sites. Organizations should also expect staff addresses to be in the list if people signed up with work email.
- Records exposed.
- 31 million, according to Have I Been Pwned.
- Data types.
- Email addresses, usernames and bcrypt password hashes.
- Public disclosure.
- 9 October 2024, after a JavaScript alert appeared on the site.
- Latest record date.
- 28 September 2024.
- Second attack.
- A DDoS attack claimed by the group BlackMeta.
What should you do now?
Check your address on Have I Been Pwned, change the Internet Archive password and any other account that shares it, and be careful with email that claims to come from the service. The fix for reuse is a password manager that creates a different password for each site.
- Search your email address on Have I Been PwnedIt shows whether it is in this breach.
- Change the Internet Archive passwordUse a long, unique one.
- Change the same password on every other siteStart with email and banking.
- Turn on two-factor sign-in where it is offeredA stolen password alone then stops working.
- Ignore links in unexpected messages about the breachOpen the site by typing the address.