The hackers from Internet Archive maintain access to internal email tools.

This morning, a user received an email apparently sent by "The Internet Archive Team" in response to a message they had sent on October 9. However, this message did not come from the support team responsible for the digital archive, but seems to have been drafted by the hackers who accessed the platform earlier this month, who still have limited access to the organization’s systems.

This is not the only case; other users on the Internet Archive subreddit have also reported receiving similar replies. The message in question reveals that, despite the organization being informed about the breach two weeks ago, it has not taken the necessary steps to rotate many of the API keys that were exposed in their GitLab secrets. The message also mentions a Zendesk token that allows access to over 800,000 support tickets sent to info@archive.org since 2018. This means that the personal information of those who attempted to make inquiries or request the removal of their site from the Wayback Machine is now in the hands of unauthorized individuals.

The situation has raised concerns about the security of user information. Meanwhile, the Internet Archive has begun to restore some of its functions after the attack, partially reactivating its main service, the Wayback Machine. However, its vast collection of data, which includes books, software, images, videos, and digital files, remains inaccessible. Brewster Kahle, founder of the Internet Archive, commented that his team is working hard to restore the organization’s services, though full recovery will take time and will initially start in a read-only mode in the coming days.

The reasons behind this attack remain unclear. Kahle stated that he has no clear information on the matter, pointing out that it is inexplicable why anyone would undertake such a destructive action.