By 
Internet Archive's "The Wayback Machine" has suffered a data breach after a threat actor compromised the website and stole a user authentication database containing 31 million records.
A malicious JavaScript pop-up appeared on the Internet Archive website alerting the visitors that the Internet Archive was breached. The message read as "Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!"
The text "HIBP" refers to is the Have I Been Pwned data breach notification service created by Troy Hunt, with whom threat actors commonly share stolen data to be added to the service.
Hunt stated that the threat actor shared the Internet Archive's authentication database nine days ago and it is a 6.4GB SQL file named "ia_users.sql." The database contains authentication information for registered members, including their email addresses, screen names, password change timestamps, Bcrypt-hashed passwords, and other internal data.
The database is likely to be stolen on September 28th, 2024 and there are 31 million unique email addresses in the database, with many subscribed to the HIBP data breach notification service. The data will soon be added to HIBP, allowing users to enter their email and confirm if their data was exposed in this breach.
Hunt says he contacted the Internet Archive and began a disclosure process, stating that the data would be loaded into the service in 72 hours, but he has not heard back since.
It is not known how the threat actors breached the Internet Archive and if any other data was stolen.
The Internet Archive also suffered a DDoS attack, which has now been claimed by the BlackMeta hacktivist group, who says they will be conducting additional attacks.
Internet Archive founder Brewster Kahle later shared an update on X, confirming the data breach and stated that the threat actor used a JavaScript library to show the alerts to visitors.
"What we know: DDOS attacked-fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords," reads a first status update tweeted last night.
"What we've done: Disabled the JS library, scrubbing systems, upgrading security."
According to a second update shared this morning, DDoS attacks have resumed, taking archive.org and openlibrary.org offline again.
While the Internet Archive is facing both a data breach and DDoS attacks at the same time, it is not sure that the two attacks are connected.
