Internet Archive hacked and 31 million user accounts leaked — hacking group ‘SN_Blackmeta’ claims responsibility

According to Internet Archive founder Brewster Kahle and ‘Have I been Pwned?’ founder Troy Hunt via Bleeping Computer The Internet Archive was hacked. Resulting in a data breach of its user authentication database containing 31 million accounts.  Users found out when they saw the website displaying a JavaScript alert to let visitors know the site was breached. Along with the data breach, the website was defaced and DDoS’d (Distributed Denial of Service). 

The following was the message on the pop-up:

“Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!.”

Data breach look-up website ‘Have I been Pwned?’ (HIBP) Creator Troy Hunt confirmed that the they received the user database as a 6.4 GB SQL file approximately nine days ago. It was further confirmed that it contained the email addresses, screen names Bcrypt-hashed passwords and the timestamps of password changes. Based on a timestamp in the last entry in the database, it is likely it was hacked on September 28, 2024. HIBP subscribers, just like one of our editors, received a notification after the hack was confirmed by the Internet Archive. 

Hunt confirmed that The Internet Archive has begun its disclosure process and The Internet Archive team confirmed that the data would be loaded into the service in 72 hours, he has not received any communication from the team, since. It is also not known how the hack was possible, resulting in such a large user data leak.

Jason Scott from the Internet Archive confirmed that they’ve disabled the JavaScript library, scrubbed the systems and upgraded security. At the time of writing, neither The Internet Archive nor The WayBack Machine is back online. He confirmed that no reasoning or demands were made to them. As of now, an account on X called SN_Blackmeta claims responsibility for this hack and also said they are planning another attack tomorrow. The target for the next website is not revealed at this time. Internet Archive has also not yet published any public statement.

The Internet Archive carries a wealth of information from internet resources to books, news, footage, videos, music and other information, accessible and available to the public. One will be able to reset their passwords once the website is up and perhaps receive an email from IA for a reset. It should also be noted that The Internet Archive confirmed in May this year that it is facing sustained attacks and a result has been struggling against such attacks. 

It is also best if users have random passwords for different websites to avoid any situation of a leaked password used by anyone to access accounts of other websites and services. For those who use the same password for multiple websites, it is best if those are also changed.