The Internet Archive, one of the internet’s most critical digital libraries and home to the Wayback Machine, suffered a devastating security breach on October 9, 2024, exposing the personal data of approximately 31 million users. The incident, which combined a data breach with a simultaneous Distributed Denial of Service (DDoS) attack, highlights the cascading risks that organizations face when basic security hygiene is neglected over extended periods.
The Exploit Mechanics
The root cause of the breach was shockingly simple: an exposed GitLab authentication token that had been left vulnerable since late 2022. This single oversight gave attackers uninterrupted access to the Internet Archive’s source code repository for nearly two years. The threat actor exploited this token to gain unauthorized access to the organization’s authentication database, which contained records for approximately 31 million registered users.
The stolen data included email addresses, screen names, Bcrypt-hashed passwords, and password change timestamps. While Bcrypt hashing provides a meaningful layer of protection — it is computationally expensive to crack — the sheer volume of exposed records makes this breach particularly concerning, especially for users who reuse passwords across multiple platforms, including cryptocurrency exchanges and wallet services.
Simultaneously, a pro-Palestinian hacktivist group known as SN_BlackMeta launched a DDoS attack against the Archive’s infrastructure, overwhelming servers with traffic and temporarily taking the site offline. The data breach and the DDoS attack were conducted by separate groups, but their simultaneous execution compounded the damage and disrupted incident response efforts.
Affected Systems
The breach extended beyond the initial authentication database. The exposed GitLab token provided access to the Internet Archive’s source code, potentially allowing attackers to identify additional vulnerabilities or plant backdoors. Subsequent investigations revealed that the attackers later exploited unrotated Zendesk API tokens to access the Archive’s support ticket platform, where users had submitted personal identification documents.
For the cryptocurrency community, the breach carries particular significance. Many blockchain researchers, developers, and crypto enthusiasts maintain Internet Archive accounts for accessing historical blockchain data, archived whitepapers, and deprecated protocol documentation. The exposure of email addresses linked to these accounts creates potential vectors for targeted phishing attacks against individuals involved in the crypto space.
Bitcoin was trading at approximately $60,582 at the time of the breach, with Ethereum at $2,368, according to CoinMarketCap data. The crypto market was already under pressure from PlusToken-related ETH liquidations, and the broader cybersecurity concerns added to an atmosphere of heightened vigilance among digital asset holders.
The Mitigation Strategy
The Internet Archive’s founder, Brewster Kahle, acknowledged the breach and confirmed that the organization was working to secure its infrastructure. The mitigation process involved rotating all exposed authentication tokens, conducting a comprehensive audit of access controls, and rebuilding the authentication database with enhanced security measures.
For users, the immediate response should include changing passwords not only on the Internet Archive but on any platform where the same password was reused. Enabling two-factor authentication on all cryptocurrency-related accounts is critical, particularly exchange accounts and email addresses associated with wallet recovery phrases.
Security professionals recommend that organizations implement automated token rotation policies, ensuring that access tokens are refreshed at regular intervals regardless of perceived risk levels. The two-year window during which the GitLab token remained exposed represents a fundamental failure in basic security operations.
Lessons Learned
This breach serves as a stark reminder that some of the most damaging security incidents result not from sophisticated zero-day exploits but from basic operational oversights. A GitLab token left exposed for two years provided the entry point for a breach affecting 31 million users. The lesson is clear: security hygiene fundamentals — token rotation, access audits, and credential management — remain the most critical defenses against data breaches.
For the cryptocurrency community, the incident reinforces the importance of unique passwords for every service, hardware-based two-factor authentication, and vigilance against phishing attempts that may leverage breached email addresses. The intersection of general internet security breaches and cryptocurrency-specific threats means that a breach on any platform can cascade into crypto-related attacks.
User Action Required
If you held an Internet Archive account before October 9, 2024, take the following steps immediately: change your Internet Archive password, change the password on any account where you reused the same credentials, enable two-factor authentication on all financial and cryptocurrency accounts, monitor your email for phishing attempts referencing the breach, and consider using a hardware security key for your most sensitive accounts. The exposure of 31 million email addresses creates a long-tail risk that will persist for months or years as attackers leverage the data in targeted campaigns.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified professionals for your specific security needs.
a gitlab token sitting there for TWO YEARS. this is not a sophisticated attack, its pure negligence
31 million records and bcrypt hashes. depends on the cost factor they used but hashcat can chew through a lot of those if its under 12 rounds
Katarina M. bcrypt cost factor 10 is crackable on a rig of 8 RTX 4090s in about a month for 31M hashes. if they used cost 14 its a different story but most 2022 setups used 10
two years and nobody ran a basic secret scan. not even a rotated token. this is infra 101
two years is generous. some orgs have tokens from 2016 still active. secret rotation is one of those things everyone knows they should do and nobody actually does
null_pointer secret scanners like trufflehog and gitleaks are free. no excuse for a 2 year old token in a repo with 31M user records downstream
a gitlab token sitting since 2022 is wild. trufflehog runs in CI for free and nobody bothered. 31M users paid for that negligence
git_leak_patrol_ trufflehog is literally free and takes 5 minutes to set up in CI. no excuse for a 2 year old token anywhere
the wayback machine is literally irreplaceable and theyre running it on security practices from 2018. terrifying
the wayback machine is a public good running on donations and hope. the fact that its still standing is the real miracle
running on donations and hope is exactly right. the wayback machine gets more traffic than most gov websites and operates on a fraction of the budget
31 million users trusting the wayback machine with their data and the org couldnt even rotate a gitlab token. devastating
31M email addresses from the wayback machine registration. expect a wave of highly targeted phishing campaigns using your browsing history as social engineering ammo
31M users and a GitLab token from 2022. the Wayback Machine is irreplaceable but whoever managed their infra treated security as an afterthought for years
breach plus simultaneous DDoS so the status page lied while the data walked. rough week for the org busy archiving the entire internet
bcrypt cost factor 10 on 31M hashes is crackable in weeks on consumer GPUs. should have been rotated to cost 12+ years ago. basic hygiene that costs nothing
Pavel J. cost factor aside, the real failure was no secret scanning in CI. trufflehog is free and takes 5 minutes. two years of exposure for zero reason
five minutes of secret scanning versus two years of exposure. guarantee a bunch of dev teams read this story and finally turned on push protection lol
turned on push protection lol, same. every dev reading this immediately thought of that one token sitting in some slack channel from 3 jobs ago
cost 12 was table stakes by 2020 for a 31M row auth db. and Klara is right, consumer GPUs chew through cost 10 in weeks
Tomoko I. cost factor 10 bcrypt with 31M hashes on modern GPUs is maybe 3 weeks not a month. archive should have rotated that token in 2023 minimum
A token exposed since late 2022 while 31 million accounts hung off that repo. The donate button worked the entire time though
donate button up the whole time, secrets never rotated once. the archive needed a security budget more than another terabyte of crawls
the brutal part is a proper security hire costs maybe 200k a year. they ran 31M users on fumes because the internet decided archiving matters, just not enough to fund it
two years of token access means attackers read the auth db schema long before they took it. this wasnt a smash and grab, it was a subscription