The Internet Archive has suffered another security breach, this time through its Zendesk email support platform, following repeated warnings about exposed GitLab authentication tokens. The breach has compromised over 800,000 support tickets dating back to 2018, putting user data at risk, including individuals who requested the removal of their websites from the Wayback Machine.
Reports indicate that despite being notified about the exposed GitLab tokens weeks ago, the Internet Archive failed to rotate critical API keys, leaving their Zendesk platform vulnerable. An email from the threat actor, shared with affected users, revealed that the breach included access to Internet Archive’s support tickets, saying, “Whether you were trying to ask a general question or requesting the removal of your site from the Wayback Machine, your data is now in the hands of some random guy.”
This breach follows a prior incident in early October when the Internet Archive was simultaneously targeted by two attacks: a data breach in which the personal data of 33 million users was stolen and a Distributed Denial-of-Service (DDoS) attack conducted by a pro-Palestinian group named SN_BlackMeta. While many outlets incorrectly attributed both incidents to the same group, the data breach and the DDoS attack were carried out by different actors.
The initial breach was traced to an exposed GitLab configuration file found on one of the Internet Archive’s development servers. This file contained a GitLab authentication token that had been accessible online since at least December 2022. The threat actor claims they were able to use this token to download the organization’s source code, which contained additional credentials and authentication tokens, including access to the Internet Archive’s database management system. From there, the hacker alleges to have stolen 7TB of data, although no samples have been shared to verify the claim.
Despite BleepingComputer’s attempts to notify the Internet Archive about the breach, including offers to share details of how the attack occurred, the organization has not responded to these warnings. As of now, the stolen data, including information from the Zendesk platform, is believed to be circulating within hacking communities. It is likely that it will appear on forums such as Breached in the future. The Internet Archive has yet to issue a formal response to this latest breach, leaving affected users concerned about the security of their personal information.
