The Internet Archive, the nonprofit library behind the Wayback Machine, suffered a data breach in 2024 that exposed 31.1 million user account records. Attackers exploited a misconfiguration to access the system directly. The breach occurred alongside a separate distributed denial-of-service (DDoS) attack that took archive.org and openlibrary.org offline, suggesting multiple threat actors targeted the organization at the same time. Founder Brewster Kahle publicly confirmed that the Archive's core archival collections remained intact. The exposed records included email addresses, usernames, and bcrypt password hashes. Bcrypt is a hashing algorithm that makes passwords harder to crack than simpler formats, but it does not make them immune to attack. Beyond the credentials themselves, the breach poses a broader risk: the Archive's usage history can reveal research interests, ideological associations, or patterns of activity that users may have considered private. This makes affected accounts a target not just for credential abuse but for phishing and identity profiling. No major regulatory actions have been publicly confirmed in connection with this breach. Affected users face the practical risk of credential stuffing attacks if they reuse passwords across other sites, as well as targeted phishing using their exposed email addresses and usernames. Anyone with an Internet Archive account should treat their password as compromised and update it anywhere it was reused.

Digital archive platforms collect user accounts, emails, donation records, upload activity, borrowing or access history, and in some cases community participation data tied to preservation and library services.

The most consequential recent development for the Internet Archive has been a series of adverse copyright rulings. In September 2024 the U.S. Court of Appeals for the Second Circuit affirmed that its controlled digital lending of scanned books constituted copyright infringement. The Archive declined to petition the Supreme Court before the December 2024 deadline, leaving a permanent injunction in place and more than 500,000 titles removed from its lending collection. A separate $621 million lawsuit brought by major record labels over its Great 78 Project digitization effort settled in September 2025. In parallel, in 2024 Google began including Wayback Machine links in Search results, effectively replacing its own deprecated Google Cache service.