Internet Archive Under Siege: A Cascade of Cyberattacks Exposes Website Data

Summary

The Internet Archive, a vital digital library, experienced a series of cyberattacks in October 2024. These attacks included DDoS disruptions, data breaches exposing user information, and unauthorized access to internal systems. The incidents highlight critical security vulnerabilities and the importance of robust cybersecurity practices for all organizations, especially those preserving valuable data. The archive is working on recovery and implementing stronger security measures.

TrueNAS: robust data security and expert support to protect your digital assets.

Main Story

Okay, so you won’t believe what the Internet Archive went through recently. I mean, we all rely on them, right? Especially that Wayback Machine – a lifesaver for anyone doing research or just feeling nostalgic. But man, October 2024 was not their month. They got hit, and hit hard, by a series of cyberattacks. And honestly, it really makes you think about the security of these online archives.

First up, on October 9th, it was like a double whammy. Hackers got their hands on an old GitLab token, apparently left exposed since 2022 – talk about a security oversight! Using that, they swiped data on about 31 million users. Think usernames, emails, and those bcrypt-hashed passwords. Ouch. But that’s not all; simultaneously, they faced a DDoS attack from some pro-Palestinian group. Talk about being overwhelmed. That made their websites and services totally inaccessible.

Then, like, mid-October, it happened again! More unrotated access tokens, this time leading to their Zendesk support platform. I heard, thousands of support tickets were exposed, all the way back to 2018. And get this, some probably had personal IDs from users needing help or wanting content removed. Really highlights why you gotta rotate those API tokens regularly. And also, good access control is so important.

If you thought that was the end of it? Nope. On October 20th, they got hit again, but this time with a taunt. The hackers sent a mass email to users who’d used the support platform, just bragging about how bad the Archive’s security was, and how much sensitive data they had. Apparently, they had access to over 800,000 support tickets. Seriously, talk about embarrassing. I mean, who knows what they’re planning to do with all that info?

These attacks, they really underscore just how serious cyber threats are getting. It’s not just about having a firewall anymore, and there are some simple things that would have saved them a lot of grief. We’re talking proactive steps, like:

• Rotating those API keys and access tokens – seriously, it can’t be said enough! Old tokens are like open invitations for hackers.
• Access control: Give people only what they need. If they don’t need access, they shouldn’t have it. Least privilege is key, and use multi-factor authentication!
• Keep your software up to date: Patch those systems, use intrusion detection, and do regular security audits. Find the holes before the bad guys do.
• Have a plan! Incident response is key, you need to know how to handle these things before they actually happen. Fast communication is important too, don’t leave users in the dark.

The Internet Archive, they’re working on it, trying to recover and beef up their security. This is really important. Personally, I feel that it shows that cybersecurity isn’t a one-time fix. It’s a constant battle, and we’ve all got to stay vigilant if we want to keep these digital treasures safe. Like, think about it: preserving history online depends on fighting these evolving threats.