# Internet Archive hacked: 31 million user records stolen · pwn.watch

> Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.

Page: https://pwn.watch/i/internet-archive-breach-31-million · generated 2026-10-22T21:47:37.879Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Internet Archive (archive.org)
- Started: 2024-10-09 · closed: 2024-10-20

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/internet-archive-breach-31-million/feed.xml
- JSON Feed: https://pwn.watch/i/internet-archive-breach-31-million/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/internet-archive-breach-31-million.json
- This file: https://pwn.watch/i/internet-archive-breach-31-million/llms.txt

## Updates (newest first)
- 2024-10-09: archive.org shows a hacker's JavaScript alert; breach of 31M records confirmed (https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/)
- 2024-09-28: Most recent timestamp in the stolen user database (https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/)

## Fix brief
# Security brief: Internet Archive hacked: 31 million user records stolen

Source: https://pwn.watch/i/internet-archive-breach-31-million · status: closed (closed Oct 20, 2024) · severity: high · updated Oct 20, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.

Severity detail: Data breach, 31M accounts

- Product: Internet Archive (archive.org)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 9, 2024: archive.org shows a hacker's JavaScript alert; breach of 31M records confirmed
- Sep 28, 2024: Most recent timestamp in the stolen user database

## Write-ups & news
- [Internet Archive hacked, data breach impacts 31 million users](https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/)

---
Machine-readable: https://pwn.watch/i/internet-archive-breach-31-million.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.