Change your passwords. Attackers claim to have 'catastrophic' security breaches of the Internet Archive. They claim that 31 million emails, hashed passwords and other information were captured.

The Internet Archive, the online repository for, well, almost everything, is under attack. The site has been essentially rendered unusable by a series DDOS attacks since Wednesday. The non-profit's engineering team is scrambling to upgrade security and keep users informed at the same time.

The worst part is none of it. You'll find an error page if you try to visit the site as of this writing. Yesterday, visitors were greeted with a pop-up that read "Have ever felt that the Internet Archive is running on sticks and constantly on the brink of suffering a devastating security breach?" It just happened. "HiBP": See 31 million of us!

HIBP stands for Have I Been Pwned. You can use this site to check if you have been pwned. This happens with alarming regularity on the internet. The attackers of the Archive claim to have stolen the details for 31 million accounts in their campaign. This breach has been confirmed by HIBP Troy Hunt and Archive founder Brewster Kale (via Bleeping Computer).

"What we know:" wrote Kale earlier today, "DDOS attack-fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords." The bad news is if you have an Internet Archive Account, your username and email may have been captured by attackers.

The good news is the encrypted version of your password that they have obtained. Do not use this as an excuse to relax. You should absolutely update your Archive password immediately.

Kale claims that since the attack, the Archive "Disabled JS library", which was used to access the website and serve the pop-up earlier, and is "scrubbing system, upgrading security." Unfortunately, the site was unable to do much about the DDOS attack. Kale had posted less than an hour prior to my writing this that "DDOS people are back and knocked Archive.org off the air" and that the website is "being careful and prioritizing data security at the expense service availability."

It's still not clear who is behind this attack or why. An account on X going by the name SN_Blackmeta--claiming to be located in "Old Rus, Novgorod Oblast"--has claimed responsibility, saying it was attacking the Archive "because the archive belongs to the USA," whose "horrendous and hypocritical government supports the genocide that is being carried out by the terrorist state of 'Israel.'" The Archive is based in America, but has no other notable ties with the US government.

It is not clear whether the account is actually and has ties to Archive's attackers, or if it is just opportunistically taking responsibility. And whether its is its is also not clear.

The Archive does not need this problem. The site had to remove half a millon books from its lending collection earlier this year after losing a landmark lawsuit over copyright against a number publishing companies. The Archive has appealed the ruling but I can imagine Brewster Kale, and his co-workers are having a world history headache after a bad 2024.