BlackMeta attacks the Internet Archive, stealing 31M email addresses

Internet Archive, best known for its Wayback Machine, has become the victim of a cyberattack. Members of the hacktivist group BlackMeta claim to be responsible for stealing 31 million unique email addresses and to have carried out multiple DDoS attacks.

People who visited the Internet Archive’s website on Wednesday got to see a pop-up prompt. “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!” the message said.

‘HIBP’ refers to Have I Been Pwned, a data breach notification service that was created by Troy Hunt. The Australian cybersecurity expert has told BleepingComputer that a threat actor shared the Internet Archive’s authentication database, containing email addresses, screen names, password change timestamps, bcrypt-hashed passwords, and other internal data of 31 million registered members.

54 percent of the email addresses were already in the Have I Been Pwned’s security breach database, Troy Hunt says on X.

One of the affected people is cybersecurity researcher Scott Helme, who confirmed the bcrypt-hashed password in the leaked database matches the bcrypt-hashed password that is stored in his password manager. Even the timestamp when he last changed his password was the same.

Brewster Kahle, founder of the Internet Archive, acknowledges the data breach on X. He also confirms his organization was able to fend off several DDoS attacks and is currently scrubbing its systems and beefing up security.

BlackMeta claims to be the one responsible for the data breach and DDoS attacks. “The Internet Archive has and is suffering from a devastating attack. We have been launching several highly successful attacks for five long hours and, to this moment, all their systems are completely down,” the hacktivist group says on X.

Hunt has verified the data and will add it to the Have I Been Pwned database soon so users can see if their information has been leaked.