Internet Archive Breached Again, Hackers Exploited Unrotated API Tokens

The Internet Archive has fallen victim to another cyberattack, marking the third major security incident in October 2024.

On October 20, hackers successfully exploited unrotated API tokens to gain unauthorized access to the organization’s Zendesk support platform, potentially compromising sensitive user data.

This latest breach follows two previous attacks earlier in the month, highlighting the nonprofit digital library’s ongoing security challenges.

The hackers were able to access and potentially download support tickets dating back to 2018, which may include personal identification documents submitted by users.

Join ANY.RUN's FREE webinar on How to Improve Threat Investigations on Oct 23 - Register Here 

The root cause of this breach appears to be the Internet Archive’s failure to rotate API tokens for its Zendesk system despite being aware of previous security vulnerabilities. This oversight allowed attackers to maintain access to the support platform, putting user data at risk.

The Internet Archive, founded in 1996 by Brewster Kahle, is a vital resource for researchers, historians, and the general public. It is best known for its Wayback Machine, which preserves snapshots of websites over time.

As of September 2024, the Archive held over 42.1 million print materials, 13 million videos, 1.2 million software programs, and 866 billion web pages.

The series of attacks began on October 9, when hackers exploited an exposed GitLab token to access the Archive’s source code and user database, affecting 31 million users.

This initial breach was followed by a Distributed Denial of Service (DDoS) attack, further disrupting the organization’s operations.

Cybersecurity experts have expressed concern over the repeated breaches and the Archive’s inability to secure its systems effectively.

The Internet Archive’s founder, Brewster Kahle, has acknowledged the security breaches and stated that the organization is working to enhance its security measures.

However, the repeated incidents have raised questions about the Archive’s ability to protect its vast data.

As the Internet Archive works to address these security issues, users are advised to remain vigilant and monitor their accounts for any suspicious activity.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Watch Here