This short report was first published as a lead story for our Nouseletter.
31 million users of the Wayback Machine have had their account data leaked.
The leak originated from an anonymous hacker, who gained access to Internet Archive's authentication database, which contains username, email and password data attached to user’s accounts. Tom’s guide, a tech journalism website, reports that the hack likely took place on September 28th, 2024.
The anonymous hacker announced the leak on 1 October by creating a pop-up on Internet Archive’s own website that stated “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!”
HIBP refers to Have I Been pwned?, an information security website that allows users to check if their details have been included in data leaks. The announcement coincided with the hacker releasing account details to HIBP.
Wayback Machine is a popular online tool that allows users to browse an archive of the entire internet. It is part of a larger suite of tools of the American non-profit digital library Internet Archive.
Internet Archive is a useful tool for researchers around the world. Journalists use it to delve through site histories, and academics use it for its massive, free library of texts and software.
Students also use it for research throughout their degrees; several subject and skills guides on the University of York Website recommend it.
Nouse spoke to one final year history student at York, who wishes to remain anonymous, about the impact the hack was having on them.
They told Nouse: “The WaybackWhen Machine and the Internet Archive are the only ways to access the primary sources for my dissertation research. Not only is it inconvenient that the breach has forced the suspension of this research, but also that my data has been stolen whilst doing this study is a massive shame, especially from something that seems highly avoidable.”
“A stronger security system ought to have been in place to safeguard user data and the sources that the archive’s one million daily user’s access for their own studies.”
Our own research confirmed that the student’s York email address was included in the leak, and that it was highly likely their password was also compromised.
The hack led to the temporary closure of Internet Archive’s website, and any associated tools like the Wayback Machine. In the last few days, a provisional, read-only version of Wayback Machine has been re-uploaded to the web, which you can find here.
A message on the Internet Archive website Other Internet Archive services are temporarily offline. Please check our official accounts, including Twitter/X, Bluesky or Mastodon for the latest information. We apologise for the inconvenience.”
Brewster Kahle, the founder of internet archive, posted on X: "What we've done: Disabled the JS library, scrubbing systems, upgrading security.”
The hack means that anyone with access to the leaked data can attempt to access users' accounts on Wayback Machine, and on other websites if they have replicated their usernames or passwords.
Missing Nouse's short-form reports? Want more of this style of news-writing? Sign-up to Nouse's weekly Nouseletter for free today! You'll hear from our news, politics and Muse editors about news that affects YOU!
Sign up by following this link: https://forms.gle/SueucQRqKziR5ovK8
