Summary

  • The Internet Archive's readable account guidance gives one recovery path: choose Forgot your password? and expect instructions by email. No page a reader can open explains how to switch on a separate second factor.
  • The archive's own account of the incident sits at two blog addresses dated October 2024, but neither rendered as publisher text here, so the notice — who was told, on what date, with which instruction — cannot yet be quoted and checked against the help centre.

The Internet Archive (archive.org, AS7941) is a strange kind of institution to hold credentials. It keeps other people's material for a living — books, film, web pages, the whole slow sediment of the open web — and it asks the people who use it for an email address and a password. That combination makes it a keeper twice over: of the assets, and of the record about the assets. When the second of those is thinner than the first, the people on the wrong side of the imbalance are the ones whose passwords were sitting in it.

Start with what the keeper publishes to help someone who has lost access. The help centre's account troubleshooting page is plain and useful: select Forgot your password? on the login page, and "You will receive an email with instructions on how to reset your password" (Accounts – Tips & Troubleshooting). The same page walks a signed-in user to Account settings, where the password is entered again before Change Account Settings opens the account's details.

The companion guide sets out how anyone gets in at all. There are three routes: "a) use your email and password, b) sign in via Google, or c) receive a one time code to your email" (Accounts – A Basic Guide). Read that carefully, because it is the sentence that decides how much the archive's account security depends on an inbox. The emailed code is an alternative to the password, not an addition to it. Recovery runs through the same address. The same guide lists what a holder can change in settings — screen name, email address — and gives no instructions anywhere for enabling a separate two-factor setting. That is not proof the service lacks one. It does mean a reader following the archive's own guidance has nothing to switch on.

The visual record is older than the question. An official help-centre screenshot shows a settings page carrying "Change Password", "New Password" and "Confirm Password" with a Change button (Account Settings screenshot). It sits in an article the help centre marks as updated on 10 June 2019, and it depicts a borrowing-history deletion option that the current account guide says does not exist. So the clearest picture of the archive's password control is seven years old and internally contradicted — documentation, not an inventory.

The destination itself refuses to be checked. Opening the linked settings address returned a notice requiring JavaScript rather than an account surface (archive.org account settings). No authenticated interface was inspected, so nothing here establishes which controls are live today. What it establishes is narrower and more useful: the one page that would settle the question is not readable from outside a browser session, which leaves the help text as the only account-side evidence anyone can weigh.

Now the incident record. The archive did post about the attack on its own blog, at two addresses whose paths carry the dates 9 October and 14 October 2024 — A Message from Brewster Kahle and Update on the Recent Cyberattack. When opened for this briefing, neither rendered as publisher text; what sat in their place was a summary rather than the archive's own words. A reader with a normal browser may well see both posts in full, and should go look. The limit is exact and it matters: the notice instrument — the population named, the date of notification, the instruction given — could not be quoted and set beside the help centre, so the two halves of the record were never placed in the same frame where an outsider could compare them.

One independent check was attempted. A search for a state attorney-general breach-notification filing naming the Internet Archive returned no candidate documents. A zero-result search is not an absence; it means the non-operator record that would have let a regulator's file speak for the archive was not found, and the keeper's own account remains the only account in reach.

Set out plainly, here is what the test asked for and what the readable record supplies. Who was told: not stated in any document quotable here. On what date: only the two October 2024 addresses. In what instrument: a blog post whose text could not be read for this piece. With what instruction: the standing password-reset instruction, which is guidance for any day, not notice of a particular one. And the durable repair — the part that would let an account holder act rather than hope — is a password form dated to 2019, and nothing published that says how to add a second lock.

BTW's earlier reporting on this institution, including a July 2026 research article that treated the 2024 crisis as several distinct risks needing distinct responses, asked what failed and what was rebuilt. This asks the narrower question those pieces left open: what a person whose credentials were in the breach was actually handed.

Two documents would change the classification, and neither is expensive. The first is the notice itself, republished or linked in a form an outsider can read, naming who was affected and what they were told to do. The second is a line of guidance that says how to enable a second factor, if one exists — the difference between a protection and an assurance. Until those exist in a checkable form, the archive's readable account record consists of a reset email and a form from the last decade, and the duty owed to the people whose passwords it holds is being discharged in private.

A keeper that publishes its failures in a form nobody can quote has not been caught hiding anything. It has chosen the cheaper record, and the cheaper record is the one that will be quoted for as long as its collections are.