The Internet Archive suffered a major data breach compromising a 6.4-gigabyte SQL database (ia_users.sql) containing 31 million user authentication records. Threat actors obtained initial access via an exposed GitLab configuration file hosted on an internet-facing development system. The leaked personal access token granted unauthorized read access to internal source repositories, allowing the actors to harvest hardcoded database credentials and API secrets. With administrative database connectivity established, the intruders exfiltrated records containing email addresses, screen names, password change timestamps, and bcrypt-hashed passwords.

Beyond data theft, the adversaries modified a JavaScript library served by archive.org to display a defacement banner publicizing the breach and citing Have I Been Pwned, where the exfiltrated dataset was independently verified. The intrusion occurred alongside a separate distributed denial-of-service attack claimed by threat group SN_BlackMeta. Founder Brewster Kahle confirmed the breach, prompting the organization to take services offline, disable the tampered JavaScript assets, revoke compromised credentials, and initiate forensic scrubbing across the environment.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Exposed developer credentials in perimeter-adjacent repositories allow adversaries to bypass perimeter inspection, chaining read access on internal source code to privileged database extraction and supply-chain script tampering within web applications.
• Bullet 2 — Strategic & Defender Imperative: Security teams must enforce automated secret scanning across all public and internal repositories, maintain automated token revocation workflows, implement centralized secret managers over hardcoded credentials, and monitor client-facing web assets for unauthorized script modifications.