Internet Archive: Security breach alert

Original Article ↗ Hacker News Discussion ↗

Internet Archive’s main site was briefly defaced with a JavaScript popup and then taken offline amid a confirmed security breach and DDoS attack, with a self‑hosted polyfill subdomain implicated in injecting the alert. A stolen database containing roughly 31 million user records (emails, usernames, bcrypt‑hashed passwords) has been verified and loaded into Have I Been Pwned, prompting users to review password hygiene, email aliasing, and 2FA practices. Commenters stress how critical the Archive is to the web’s cultural memory, debate who might be behind the attack and why, and revisit longstanding concerns about relying on a single, legally and technically fragile institution for archiving the internet.

Incident overview

  • Visitors to archive.org saw a JavaScript alert() popup claiming a “catastrophic security breach” and that “31 million” users were now on Have I Been Pwned (HIBP).
  • Users quickly confirmed the popup, then the site began returning 503/504 errors and periods of full downtime; later a “Temporarily Offline” page appeared.
  • Separate reports describe both a DDoS attack and a data breach affecting about 31M accounts, with the leaked data added to HIBP.
  • Thread participants note that media coverage initially blurred “DDoS” vs “breach,” and that final details are still emerging.

Attack vectors and technical details

  • Multiple commenters trace the popup to malicious JavaScript served from polyfill.archive.org, a self‑hosted instance of the polyfill service previously involved in a supply‑chain incident.
  • This explains the injected window.alert but not necessarily how database access was gained; whether these are the same vector is unclear.
  • A DDoS campaign against IA is credited by an online group; their claimed motives (pro‑Palestinian, anti‑US) are widely questioned, with some suggesting they are opportunistic script‑kiddies or a possible false flag.
  • There is concern about linking to a currently compromised site because it could deliver malware.

Data breach impact and security posture

  • HIBP domain and email checks confirm many IA users’ addresses are in the leak; BleepingComputer is cited for ~31M records.
  • Leaked fields reportedly include emails, usernames, and bcrypt password hashes; no confirmation that payment data was taken, but commenters stress “we don’t know that’s all.”
  • Several people find old or changed emails still present in the dump, suggesting historical data was retained or the breach window is earlier than stated.
  • Advice repeatedly emphasized: password managers, unique passwords per site, 2FA/MFA “for anything of value,” and ideally unique or aliased email addresses per service.
  • There is debate over storing 2FA seeds inside password managers: convenient and better than no 2FA, but it collapses two factors into one vault.

IA design, privacy, and accounts

  • Commenters highlight that uploader email addresses are already exposed in item metadata and account XML, viewing this as a longstanding privacy flaw IA has not fixed.
  • This sparks discussion about whether email addresses should be treated as private data, and how much linkage between identity and contributions an archive ought to expose.
  • Some ask why IA needs user accounts at all; others point out they’re required for uploads and for borrowing digitized books.

Motives, ethics, and community reaction

  • Many express anger that a public‑good, donation‑funded “library of the internet” is being attacked at all, likening it to vandalizing a public library.
  • Others speculate about enemies of IA (publishers, states) but also warn against ungrounded conspiracies and over‑attribution.
  • There’s debate over “hack value”: curiosity‑driven exploits vs destructive DDoS and mass data leaks; several invoke hacker ethics that distinguish making public data accessible from exposing private data.
  • One user notes being actively doxxed via archived social media and feeling conflicted: valuing IA while suffering from the permanence of personal PII.

Resilience, decentralization, and backups

  • The outage renews worries about IA as a global single point of failure, with frequent “Library of Alexandria” metaphors and calls for multiple independent archives.
  • Participants discuss prior/ongoing attempts to mirror or decentralize IA’s corpus (IPFS/Filecoin, torrents, Freenet/Hyphanet), noting scale and filesystem/UX challenges.
  • Rough napkin math for mirroring tens of petabytes shows hardware cost is attainable for large organizations but daunting for volunteers; tape and better compression are suggested for cold backups.
  • Several propose volunteer‑driven distributed backup schemes using personal storage plus smart redundancy and metadata tracking, though reliability, copyright, and funding remain open problems.