Internet Archive Under Multi-Vector Siege: 31M User Accounts Leaked via Compromised GitLab Token and DDoS Campaign
Over the weekend of October 9–12, 2026, the Internet Archive (archive.org)—the non-profit digital library preserving the history of the World Wide Web—suffered a catastrophic, coordinated multi-vector cyberattack. Visitors attempting to access web archives were greeted by an injected JavaScript defacement notification mocking the institution's security posture, while background telemetry confirmed the exfiltration of a 6.4 GB SQL database containing personal records and credentials for 31,081,179 registered users. Concurrently, hacktivist syndicate SN_BlackMeta pummeled archive.org infrastructure with multi-hundred gigabit Distributed Denial-of-Service (DDoS) assaults, knocking the Wayback Machine offline for days.
Anatomy of the Intrusion: GitLab Token to Database Exfiltration
The root cause of the unauthorized data access originated not from an external web exploitation framework, but from an exposed access credential in the organization's DevOps pipeline. Forensic analysis revealed that an unauthenticated developer staging server exposed a configuration environment file containing a long-lived GitLab Personal Access Token (PAT) with administrative repository permissions.
# Simulated discovery pattern of the exposed GitLab environment variables
GET /.env.backup HTTP/1.1
Host: dev-stage.archive.org
User-Agent: Mozilla/5.0 ...
# HTTP Response disclosing internal secrets:
GITLAB_API_URL="https://gitlab.archive.org/api/v4"
GITLAB_PRIVATE_TOKEN="glpat-xxxxxxxxxxxxxxxxxxxx"
DB_CLUSTER_MASTER_URI="postgresql://ia_admin:[email protected]:5432/ia_production"
Armed with this token, the attackers queried internal source repositories, extracted database connection strings, and established direct connections to an internal PostgreSQL database replica. The extracted user authentication table, titled ia_users_export.sql, contained:
- Email Addresses: 31,081,179 plaintext contact emails.
- Screen Names & Usernames: Unique platform handles dating from early platform inception through September 2024.
- Password Hashes: Passwords hashed with
bcrypt($2a$ format). While computationally expensive to crack compared to MD5 or SHA-1, weak passwords remain vulnerable to dictionary attacks and GPU hashcat cracking clusters. - Timestamp Metadata: Account creation dates, profile modification timestamps, and administrative privilege flags.
The JavaScript Defacement Mechanism
In parallel with database exfiltration, attackers leveraged write permissions within a public JavaScript asset repository to inject malicious code into the primary library bundles served by archive.org (including archive.min.js). The script generated an intrusive toast modal alerting all visitors to the breach:
/* Decompiled snippet of injected defacement payload */
(function() {
const banner = document.createElement("div");
banner.style.cssText = "position:fixed;top:10px;left:50%;transform:translateX(-50%);background:#b91c1c;color:#fff;padding:16px;z-index:999999;border-radius:8px;font-family:sans-serif;box-shadow:0 10px 25px rgba(0,0,0,0.5);";
banner.innerHTML = "Security Alert: Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!";
document.body.appendChild(banner);
})();
Troy Hunt, founder of Have I Been Pwned (HIBP), confirmed receipt of the 6.4 GB breach database, verifying that 54% of the leaked email addresses were already in the HIBP database from prior breaches, while millions were newly exposed.
Secondary Crisis: Zendesk Support Token Hijacking
Compounding the disaster, subsequent forensic audits revealed that attackers also obtained API tokens for Internet Archive's Zendesk customer support portal. Attackers leveraged these unrotated tokens to access ongoing support tickets and send mass replies to users who had submitted requests for GDPR removal or digital lending support, warning them that their data was completely in the hands of third parties.
Detection Telemetry & Threat Hunting
title: GitLab PAT Authentication from Anomalous External IP
status: production
logsource:
product: gitlab
service: audit_events
detection:
selection:
action: 'user_authenticated_via_personal_access_token'
filter_internal:
source_ip|cidr:
- '10.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
condition: selection and not filter_internal
falsepositives:
- Remote developers connecting outside corporate VPN without static IP
level: highRemediation & Incident Response Protocol
- Immediate Credential Revocation: Revoke and rotate all GitLab Personal Access Tokens, OAuth secrets, database connection passwords, and Zendesk API credentials across all enterprise environments.
- Force Global Password Invalidation: Terminate all active user sessions across archive.org and require a mandatory password reset with enforced MFA before session re-establishment.
- CDN & Subresource Integrity (SRI): Implement Subresource Integrity hashes (
integrity="sha384-...") on all external and internal JavaScript assets to prevent unauthorized browser-side modifications. - DevOps Token Hardening: Mandate short-lived (1–7 days) scoped tokens in CI/CD pipelines, prohibiting root-level PATs and enforcing automated secret-scanning engines (TruffleHog, Gitleaks) in pre-receive git hooks.
