The Internet Archive fell victim to another breach, this time on their Zendesk email support platform, as threat actors exploited exposed GitLab authentication tokens. Despite being warned in advance, Internet Archive failed to rotate these tokens, leading to unauthorized access to support tickets dating back to 2018. Surprisingly, the breach was not politically or financially motivated but rather for cyber street cred within the data breach community. The threat actor revealed how they penetrated the Internet Archive through a GitLab configuration file, acquiring sensitive information such as API access tokens. The stolen data, including user databases, has likely been circulated among other threat actors.
https://www.bleepingcomputer.com/news/security/internet-archive-breached-again-through-stolen-access-tokens/