Internet Archive user database theft and Zendesk token abuse
On October 9, 2024 the Internet Archive was defaced with a message announcing the theft of its user database, about 31 million accounts, while also under DDoS. On October 20 an attacker sent emails through the Archive's Zendesk using a still-valid API token, showing access to support tickets. BleepingComputer, as cited by Infosecurity Magazine, reported that the attacker first obtained an exposed GitLab configuration file containing an authentication token, used it to download source code, and found Zendesk tokens there that had not been rotated.
- Victim
- Internet Archive
- Industry
- Technology
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Oct 9, 2024
- Actor
- Unattributed
- Initial access
- Exposed secrets
- Identity control that failed
- Credential storage
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- 31 million (About 31 million user accounts (emails, screen names, bcrypt password hashes), as reported by The Verge from the Have I Been Pwned listing.)
- Disclosed cost
- Not disclosed
The identity lesson
A token left in a development server's configuration opened the source code, and tokens in that code opened everything else. Secret scanning and rotating every exposed token after the first breach would have stopped the second one.
Go deeper on SWI
- Technique: Secrets in repositories and CI
- Technique: Static API key abuse
Sources
- The Internet Archive is under attack, with a breach revealing info for 31 million accounts, The Verge, Oct 9, 2024
- Stolen access tokens lead to new Internet Archive breach, Infosecurity Magazine, Oct 21, 2024
- Learning from cyberattacks, Internet Archive, Nov 14, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Codecov Bash Uploader compromise via credential extracted from Docker image 2021 · Exposed secrets
- Zeabur shared cluster breached with a non-expiring admin token and plaintext AWS keys 2026 · Exposed secrets
- JadePuffer wipes Azure resources with compromised service principals 2026 · Exposed secrets
- LiteLLM poisoned PyPI and Docker release traced to a leaked, never-revoked admin key 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). Internet Archive user database theft and Zendesk token abuse. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-internet-archive-exposed-gitlab-zendesk-tokens/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.