What happened?
On 9 October 2024, visitors to archive.org were greeted by something the Internet Archive had never shown before: a pop-up, injected into the site itself, announcing that 31 million of its user accounts had been compromised. Minutes later a distributed denial-of-service attack knocked archive.org and openlibrary.org unevenly offline, and the organization spent the day restoring services in a fog of overlapping incidents – a data breach, a defacement, and a sustained traffic attack, all landing at once. By the time this post publishes on 11 October 2024, the Wayback Machine and library services are largely back, 31,081,179 email addresses have been fed into breach-notification service Have I Been Pwned, and the conversations that matter have moved past the outage to the Archive itself: a donation-funded institution, mid-lawsuit, now balancing incident response against an existential budget strain it had been publicizing for weeks.
Quick Answer: The Internet Archive was hit by a compound incident on 9 October 2024. An unauthorized JavaScript injection displayed a pop-up on archive.org claiming 31,081,179 user accounts were compromised; the dump – email addresses and bcrypt-hashed passwords from the registration database – quickly surfaced for download. Simultaneously, a DDoS campaign disrupted archive.org and openlibrary.org, knocking services offline for extended periods before staged restoration through 10-13 October. A hacktivist persona styling itself SN_BlackMeta claimed the DDoS attacks to reporters, saying it had struck the Archive before; the breach pathway took longer to establish, with the Archive later tying unauthorized access to exposed development credentials, including tokens reaching its email support systems. The episode exposed the fragility of a uniquely important nonprofit institution already strained by publisher litigation and donation-dependent funding.
The dual incident produced genuinely confusing hours. Early reports could not agree on whether the Archive had been hacked, DDoSed, or both – because it had been both, apparently by different hands. The pop-up was not a generic defacement of a static page; it was script injected into the live site, visible to real visitors, and its number – 31,081,179 – matched the dataset that began circulating almost immediately. The DDoS, meanwhile, was blunt force: waves of traffic that made the site intermittently unreachable even as engineers worked the breach. Restoring a service the world had come to treat as permanent, while simultaneously rotating credentials and assessing what an intruder had touched, is the kind of two-front war most incident teams never rehearse.
The paper trail
| Date | Event |
|---|---|
| 2024-05→06 | The group later claiming October DDoS attacks says it had already targeted the Archive in earlier months, suggesting sustained hostile attention preceding the fall incident |
| 2024-10-09 | Injected pop-up appears on archive.org announcing 31,081,179 compromised accounts; DDoS disrupts archive.org and openlibrary.org; Archive confirms security incident |
| 2024-09→10 | Stolen dataset circulates: email addresses and bcrypt password hashes from the user registration database |
| 2024-10-10 | Staged restoration begins; Wayback Machine returns first, other services follow; password resets pushed out |
| 2024-10-11 | Have I Been Pwned ingests the 31,081,179-record dataset; this post publishes with services recovering and attribution questions still open |
| 2024-10-13→20 | Founder Brewster Kahle reports services substantially restored; incident updates point to exposed development credentials, including tokens used to reach email support systems |
What the attackers actually got
The breach inventory matters because the Archive holds two very different kinds of treasure. What leaked was account data: email addresses and bcrypt-hashed passwords for the roughly 31 million people who had registered – largely to borrow books, save pages, or post reviews. What did not leak, and what no evidence suggested was touched, is the archive corpus itself – the books, recordings, television, and quarter-trillion captured web pages that make the institution irreplaceable. Bcrypt hashing is meaningful protection for ordinary passwords, and the Archive forced resets as a blanket control. But the dataset is still a phishing starter pack: a list of people intellectually engaged enough to hold Archive accounts, now individually enumerable. Anyone with an account who reused a password elsewhere faced the standard secondary risk, which is why breach-notification ingestion within forty-eight hours was the responsible move, ugly as the number looked in headlines.
Attackers, claims, and honest attribution
The attribution picture split cleanly along the two attack threads. For the DDoS, a persona calling itself SN_BlackMeta claimed responsibility to security reporters, presenting the outage work as ideologically motivated hacktivism and asserting prior campaigns against the Archive months earlier. No equivalent claim accompanied the data breach pop-up, and researchers initially treated the two as coincidental rather than coordinated – a reading the Archive later reinforced when its incident disclosure traced unauthenticated access to exposed development-side credentials, including authentication tokens that unlocked its email and support tooling. The uncomfortable takeaway is that a nonprofit running one of the world’s most-attacked websites drew both a morale-degradation attack and a data theft in the same news cycle, and only one of the two came with a return address. Mature analysis held both threads separately: the DDoS had a claimant; the breach had artifacts.
Why the Archive was already fragile
The financing story was the context that made October land so hard. The Internet Archive runs on donations and grants, had just weathered a bruising appellate loss to major book publishers over its lending programs, and had been public about needing sustained support to keep the lights on. Litigation costs, staff cuts, and infrastructure demands do not pause for incident response. The DDoS attack hit the single most visible service the organization operates – the one donors and journalists check first – meaning every hour of downtime was also an hour of reputational damage in exactly the quarter the Archive could least afford it. The breach added a second ledger: notification duties, credential hygiene work, and engineering time diverted from the digitization and preservation work that is the point of the institution. If the goal was to exhaust a small defender, the design was rational.
The resilience that got tested
What deserves equal attention is what worked. The Archive restored the Wayback Machine first because it prioritized the resource the world cannot get elsewhere – a triage judgment call that reflected institutional self-knowledge. Forced password resets, published status candor, and cooperation with breach-notification services followed within days, and the post-incident disclosure about how access was obtained – exposed development credentials and tokens – read as a genuine lesson-transfer document rather than lawyer-filtered fog. The structural recommendations that fell out of the incident are the standard litany for small high-target nonprofit institutions: segregate development infrastructure from production trust, treat configuration files holding tokens as production secrets, maintain rehearsed DDoS absorption, and fund a security baseline proportionate to being one of the most attacked nonprofit sites on the internet rather than to headcount.
- High-value nonprofit does not mean high-budget security: the Archive faces nation-state-scale attention on donation-scale resources – critical civic infrastructure persists on funding models that rarely price in adversarial load.
- Compound incidents need thread-separated response: breach response and availability defense ran simultaneously; teams that only rehearse one at a time will have an October like this one.
- Attribution claims are per-thread facts: one group claimed the DDoS, the data dump carried no credible claim; conflating the two creates false narrative certainty.
- Have I Been Pwned ingestion is victim-facing triage: rapid addition of the 31M-record set turned a leak into actionable, individual-level notification risk pricing within days.
FAQ
Were the actual books and web archives stolen?
No evidence indicated that. What circulated was the user-account database: 31,081,179 records containing email addresses and bcrypt-hashed passwords. The Archive collections – digitized books, audio, video, and Wayback Machine captures – were taken offline as a response measure and restored progressively, but no dataset from the collections surfaced in the breach materials, and the incident communications consistently framed the collection as untouched by the theft. A quarter of the internet’s documentary memory being merely unreachable for a weekend was itself the notable event.
Why would anyone DDoS the Internet Archive?
The claimed motive was ideological hacktivism – the persona that took credit framed the attacks in political terms, and told reporters it had targeted the Archive repeatedly in prior months. But the more durable lesson is motive-agnostic: the Archive is a singular, irreplaceable, donation-funded service with enormous public visibility and no commercial redundancy, which makes it an attractive target for anyone seeking impact per unit of effort – whether for ideology, attention, or extortion leverage. The defending institution cannot select its attackers’ reasons, only its own readiness.
What should a registered Archive user have done?
The standard post-breach playbook, executed in order: change the Archive password immediately (forced resets eventually handled this), stop reusing that password anywhere else – especially email, since addresses were in the dump and phishers knew who to target – and expect lures referencing Archive accounts, donations, or breach updates in the following months. Because passwords were bcrypt-hashed rather than stored plainly, the practical risk concentrated on weak passwords and reuse, but the phishing-enumeration risk applied to all 31 million regardless of password strength.
Legacy: single points of cultural failure
The October 2024 Internet Archive incident joined a small genre: infrastructure everyone assumes is permanent, held up by an organization small enough to be knocked down. The pop-up number – 31,081,179 – became shorthand for the users; the outage taught the lesson about the corpus. What the year left behind was a sharper question about critical internet institutions: who funds their defense, and at what level of adversarial reality? The Archive answered the way it always has – publicly, messily, and still standing – and came out of the incident with hardened credentials, a tougher DDoS posture, and a donor base reminded that permanence, on the internet, is a subscription someone has to keep paying for. The fight for funding that framed these headlines was not incidental context; it was the vulnerability underneath the vulnerability.
