Internet Archive: the token nobody rotated
31 million accounts leaked, then attackers came back. Reports point to an access token left unrotated for almost two years.
This month the Internet Archive, home of the Wayback Machine, had a rough few weeks: a defaced site, DDoS attacks and a leak of about 31 million user records, emails and hashed passwords. Then, after it came back online, the attackers showed they still had access to its support system.
According to reports, the way back in was simple: an access token for its code platform that had been exposed since late 2022 and never rotated.
If you have an account there, change that password, and anywhere else you used it.
If you run systems, the lesson is about after the incident:
- Assume every secret the attacker could see is gone: API tokens, service keys, database passwords, cloud keys. Rotate all of them, not only the obvious one.
- Check the integrations, such as support desks, code platforms and CI tools. They often hold powerful tokens.
- Watch for the return visit. Attackers often keep a second way in.
Cleaning up the website isn’t the end of an incident. Rotating the keys is.