Internet Archive archive.org Internet Archive data breach: what happened and what to do
In September 2024, a breach of the Internet Archive exposed 31,081,179 accounts: email addresses, screen names and bcrypt password hashes. Visitors saw a pop-up on archive.org in early October announcing the breach.
View all 13,115 breaches- Breach date
- 28 Sept 2024
- Made public
- 9 Oct 2024
- Affected
- 31,081,179
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
The Internet Archive runs the Wayback Machine and a huge free digital library, and many people have an account there without thinking about it. In autumn 2024 its user database was stolen.
What happened
Have I Been Pwned dates the breach to 28 September 2024 and counts 31,081,179 unique records. In early October, visitors to archive.org saw a pop-up reading "See 31 million of you on HIBP!". Have I Been Pwned's Troy Hunt confirmed the data was real, and the entry was added on 9 October 2024. BleepingComputer reported on the breach as it unfolded.
Around the same time the site also faced denial of service attacks. Reports haven't established whether the two incidents are linked. Founder Brewster Kahle said on 10 October that attackers had used a compromised JavaScript library to show the pop-ups, and that the Archive was disabling the library, scrubbing its systems and upgrading security. He said the Archive's data hadn't been corrupted.
What was exposed
The records held email addresses, usernames (screen names) and bcrypt password hashes. Nothing else is listed in Have I Been Pwned's entry, and the coverage found no sign that financial information or other highly sensitive personal details were affected.
Bcrypt is a slow way of scrambling passwords, built to make each guess expensive. That makes stolen hashes harder to use than plain text passwords. It doesn't make them safe if the password was short or common, and criminals work through the weak ones first.
Why a library account matters
It's not obvious why anyone would target your reading history. The value is in the email and password pair. People reuse passwords, and a cracked Internet Archive password can open an email account, a shop or a bank login if it's the same one. Your email address, now on a list of 31 million, also gets sold to spammers and phishers.
What the Archive did
The Archive pulled the compromised library and tightened its systems, according to Kahle's statements. It stayed online with disruptions while it dealt with the attacks. For anything more specific, such as any emails sent to account holders, go to the Archive's own announcements.
Should you worry?
If you have a strong, unique Internet Archive password, your risk is low. If you used that password anywhere else, change those other accounts first, since they're the ones criminals try.
What the pop-up told people
The pop-up on archive.org was unusual because the attackers announced the breach to visitors themselves. That's rare. Most account leaks surface weeks or years later on a sale listing or through a researcher. Here the story was public almost at once, which means you can treat 28 September 2024 as the date to think about when you last changed your password. If you haven't changed it since then, do it now.
What to do if you were in it
- 1
Change your Internet Archive password
Make it long and unique. Then change the same password anywhere else you used it, starting with your email.
- 2
Use a password manager
It creates and remembers a different password for each site, so a leak like this stays contained.
- 3
Turn on two-factor authentication
Use an authenticator app or passkey on your email and other key accounts so a stolen password can't open them alone.
- 4
Watch for phishing
Be wary of emails that claim to be from the Internet Archive or mention the breach. Go to the site directly rather than clicking.
- 5
Check which breaches include your email
Run a free Serus scan to see whether your email address appears in this and other breaches.
Frequently asked
Was I affected by the Internet Archive breach?
If you had an account in September 2024, probably. Have I Been Pwned lists 31,081,179 records, and you can search your email there or run a free Serus scan.
What was exposed in the Internet Archive breach?
Email addresses, screen names and bcrypt password hashes.
Should I change my password?
Yes, and change it anywhere you reused it. Bcrypt hashes are hard to crack but weak passwords can still fall.
Were payment details exposed?
Have I Been Pwned lists only emails, screen names and password hashes, and coverage found no sign of financial data.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
