Internet Archive Suffers 'Catastrophic' Breach Impacting 31 Million Users

BleepingComputer's Lawrence Abrams: Internet Archive's "The Wayback Machine" has suffered a data breach after a threat actor compromised the website and stole a user authentication database containing 31 million unique records. News of the breach began circulating Wednesday afternoon after visitors to archive.org began seeing a JavaScript alert created by the hacker, stating that the Internet Archive was breached.

"Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!," reads a JavaScript alert shown on the compromised archive.org site. The text "HIBP" refers to is the Have I Been Pwned data breach notification service created by Troy Hunt, with whom threat actors commonly share stolen data to be added to the service.

Hunt told BleepingComputer that the threat actor shared the Internet Archive's authentication database nine days ago and it is a 6.4GB SQL file named "ia_users.sql." The database contains authentication information for registered members, including their email addresses, screen names, password change timestamps, Bcrypt-hashed passwords, and other internal data. Hunt says there are 31 million unique email addresses in the database, with many subscribed to the HIBP data breach notification service. The data will soon be added to HIBP, allowing users to enter their email and confirm if their data was exposed in this breach.

From Troy Hunt via LinkedIn

[awwshit]

"Yep, I’m aware, more soon"

Re:

[awwshit]

https://www.linkedin.com/feed/... [linkedin.com]

Re:

[Seven Spirals]

Could be. In any case, the fact that it can be mass adulterated and compromised with spyware/trojans/ransomware means if you care about the stuff that they archive, make a copy for yourself and don't trust anyone to do it for you or keep it.

"Threat actor?"

[Valgrus Thunderaxe]

Is this the new euphemism for Russian counterintelligence? Why not just say so? Journalists should write clearly.

Re:

[alvinrod]

Could be the Chinese, Iranians, or any of the other dozens of countries that we've pissed off enough to do it, or some non-state actor from any of dozens of other countries poor enough where cybercrime pays better than any honest job and the government doesn't care about stopping it so there's very little detriment to engaging in it. I wouldn't assume that we necessarily know who's responsible and even if we do there may not be any upside to us advertising the fact if we can't actually do anything about it.

Re:

[Rockoon]

..and why would you two assume its an enemy of america, exactly?

got some teem forming political dick in your mouths?

Re:"Threat actor?"

[Moryath]

More likely, a paid actor operating on behalf of one of the copyright mafia-cartels.

Re:

[paralumina01]

More likely this. Goes with their MO set over the past 20 years.

Re:

[timeOday]

I'm not understanding the motive or payoff of hacking the wayback machine.

Re:

[Seven Spirals]

You want as much bad karma as you can possibly get with one action and you don't have a nuke?

Re: "Threat actor?"

[50000BTU_barbecue]

Russians? I was told they need washing machine microcontrollers to support their antiquated army populated by drunks?
Or do you regularly see Russians behind every banal event that has a dozen other much more likely answers?

Re:

[Seven Spirals]

About a third of /. is wild-eyed partisans who see Russian agents and "paid Putin trolls" under every bush and behind every plot. There EVERYWHERE doncha know? There gonna GET us.

Yeah it gets tiresome, but clueless morons gotta do their thing, too. In this case, follow the rest of their tribe over the edge of some ridiculous conspiracy cliff and remain completely ignorant of recent history (2014 coup) or distant history (WW2 Nazi sympathizing, USSR membership, etc...). The Party wants it; so they are exp

Oh no!

[drinkypoo]

Well, anyway...

Hashed passwords and email addresses. If you don't reuse passwords, no problem.

So what was the point of this?

[Red_Chaos1]

They managed to hack it, nabbed the data, then handed it to the owner of HIBP. Is this to make some kind of a point about security? Or maybe to goad people into donating more so they can update/fix infrastructure or something?