Change your passwords: Attackers claim a 'catastrophic security breach' of the Internet Archive, with 31 million emails and hashed passwords captured

Archive.org, a donation driven non-profit that digitizes out-of-copyright books at U of T, has such little funding that they will have to lay off 2/3 of the 35-strong staff by August 12 unless more money comes in. July 8, 2011

(Image credit: Carlos Osorio/Toronto Star via Getty Images)

The Internet Archive—the online repository of, well, pretty much everything—is under attack. It's been hit by a series of DDOSes that have rendered the site essentially unusable since Wednesday, with the non-profit's engineers scrambling to fend off the assault, upgrade security, and keep users informed all at the same time.

None of which, alarmingly, is the worst part. If you try to go to the site at time of writing, you'll just find an error page, but visitors yesterday were greeted by a pop-up reading "Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!"

HIBP means Have I Been Pwned, a site you can use to check if your emails and passwords have been leaked in any of the data breaches that happen with disconcerting regularity online. In other words: The Archive's attackers are claiming to have nicked the deets for around 31 million accounts as part of their campaign, a breach which has since been confirmed by Archive founder Brewster Kale and HIBP's Troy Hunt (via Bleeping Computer).

"What we know:" wrote Kale earlier today, "DDOS attack–fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords." The bad news is that you have an Internet Archive account, your username and email could well have been captured by the site's attackers.

The good news is that the version of your password they've gotten hold of is encrypted. Don't use that as an excuse to rest on your laurels, though: You should absolutely change your Archive password as soon as you can—and change it anywhere else you use that password, too.

Since the attack, Kale says that the Archive has "Disabled the JS library" used to access the site and serve the earlier pop-up, and that it is "scrubbing systems, upgrading security." Unfortunately, there's not much the site has been able to do about the DDOS attacks. Less than an hour before I wrote this, Kale posted that "DDOS folks are back and knocked Archive.org and Openlibrary.org offline," and that the site is "being cautious and prioritizing keeping data safe at the expense of service availability."

It's not entirely clear just yet who is behind the attack or what their reasons are. An account on X going by the name SN_Blackmeta—claiming to be located in "Old Rus, Novgorod Oblast"—has claimed responsibility, saying it was attacking the Archive "because the archive belongs to the USA," whose "horrendous and hypocritical government supports the genocide that is being carried out by the terrorist state of 'Israel.'" It's worth noting that the Archive has no notable ties to the US government beyond being based in America.

One of Josh's first memories is of playing Quake 2 on the family computer when he was much too young to be doing that, and he's been irreparably game-brained ever since. His writing has been featured in Vice, Fanbyte, and the Financial Times. He'll play pretty much anything, and has written far too much on everything from visual novels to Assassin's Creed. His most profound loves are for CRPGs, immersive sims, and any game whose ambition outstrips its budget. He thinks you're all far too mean about Deus Ex: Invisible War.