The Internet Archive faces a severe cybersecurity threat, including a massive data breach and ongoing DDoS attacks. Credit: DBenitostock via GETTY

A devastating cyberattack has hit the Internet Archive, a non-profit digital library, compromising sensitive information of millions of its users. The organization, which preserves digital media, including websites through The Wayback Machine, has been battling distributed denial of service (DDoS) attacks since the start of the week, resulting in prolonged periods of inaccessibility.

Internet Archive digital librarian Brewster Kahle took to his X account to post, “@internetarchive is being cautious and prioritizing keeping data safe at the expense of service availability.”

However, the DDoS attacks are not the only concern for the Internet Archive. The organization has also suffered a massive data breach, with emails, screen names, and encrypted passwords of 31 million Internet Archive users stolen. At this time, it is unclear whether the data breach and the DDoS attacks are related. If you're concerned about your data, you can check if you've been affected on computerstechnicians.

Internet Archive Under Siege: Data Breach and DDoS Attacks

In addition to the downtime caused by the DDoS attacks, social media users began noticing a pop-up prompt on the Internet Archive’s website on Wednesday.

The prompt read, “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”

HIBP refers to the website Have I Been Pwned, which notifies users if their data was involved in a data breach.

According to Bleeping Computer, Have I Been Pwned founder Troy Hunt confirmed that they had received a 6.4GB SQL database file containing users’ “email addresses, screen names, password change timestamps, Bcrypt-hashed passwords, and other internal data.”

Hunt has verified the authenticity of the stolen data. According to the timestamp, it appears that the breach occurred on September 28, 2024. Before loading the data into the Have I Been Pwned service, Hunt reached out to the Internet Archive, but has yet to receive a response.

A self-proclaimed entity, SN-Blackmeta, has claimed responsibility for the devastating DDoS assault. Nevertheless, it remains ambiguous whether they are also accountable for the data infringement. The group alleges that the attack was instigated by the United States' backing of Israel, and that the Internet Archive is, in their view, an American entity. Numerous social media users have been prompt to rectify this misconception, highlighting that the Internet Archive is, in fact, an autonomous non-profit organization devoid of any affiliation with the U.S. government.

We have reached out to the Internet Archive for additional information regarding the attacks and will provide updates as more details emerge.