TheNumbers.com AI Crawler Attack Forced a Full Website Rebuild

TheNumbers.com went offline on March 5, 2026, after automated traffic overwhelmed a 30-year-old system and security logs revealed sustained probing for back doors. The TheNumbers.com AI crawler attack did more than interrupt a popular film database. It forced its small team to abandon approximately 160,000 legacy source files and rebuild the public website on new infrastructure.

The site returned on March 13, but only as a reduced version. Historical charts, individual movie pages, and the Report Builder were missing. According to founder Bruce Nash, humans represented only about 10% of traffic by early 2026. AI bots and other automated systems generated the remaining 90%.

That imbalance is the central conflict. The open web once traded machine access for human discovery. Search engines indexed pages and sent readers back. AI crawlers and agents can consume far more material while returning little traffic, creating a costly relationship for independent publishers.

The shutdown also included a more troubling uncertainty. Server logs reportedly showed both legitimate scraping and attempts to find hidden access points. No public evidence identifies an attacker or proves that the probing caused the final collapse.

The clearest conclusion is narrower, but still serious. Heavy automated traffic consumed the team’s resources while repeated security probing made restoring the old system too dangerous. An authoritative public database became both valuable training material and a potentially profitable attack surface.

TheNumbers.com AI Crawler Attack Removed More Than a Website

The March outage replaced a mature public reference system with a temporary shell because safely restoring the old server was no longer practical.

The Numbers is an independent film-data service founded by mathematician and former IBM developer Bruce Nash. It began in 1997 as a Geocities project covering 300 films. By early 2026, its database tracked 78,396 movies, 178,375 theatrical release records, and 236,176 people.

Its value came from more than scale. The team collected and maintained box-office grosses, release histories, production budgets, home-video results, and streaming information. Journalists, researchers, filmmakers, and industry analysts treated it as an important reference source.

Stephen Follows reported that the site received more than eight million visits annually before the outage. His detailed outage account is based on an extended interview with Nash. It remains the primary public source for the incident’s technical timeline and internal estimates.

The site disappeared during the early hours of March 5. Users received no detailed explanation, which encouraged speculation that features were being withheld to push visitors toward commercial products. The limited public message simply said that the team was rebuilding.

When the site returned eight days later, it could still publish current box-office figures. However, much of the historical interface was gone. Users could no longer browse many familiar charts, open complete film pages, or build custom reports as before.

The reduction was not a planned redesign. Nash said a cybersecurity contact advised the team to leave the old server offline permanently. Restoring a backup would also restore the same sprawling attack surface that automated systems had already spent months examining.

That distinction matters. A backup preserves software and data, but it also preserves outdated dependencies, exposed endpoints, and undocumented behavior. Bringing the server back online could have placed it immediately within reach of the same bots and possible attackers.

Nash described the old codebase as approximately 160,000 source files serving about two million pages. That architecture had accumulated across nearly three decades. Even a competent small team could not rapidly inspect every component, patch every weakness, and prove the whole system safe.

The Numbers therefore moved the latest essential data onto new infrastructure. The team chose a controlled recovery over a fast restoration. Features would return gradually as engineers rebuilt them within a system designed for present-day traffic and security conditions.

The public site was not the company’s entire business. Bulk data supplied through OpusData, comparison analysis for filmmakers and investors, and a subscription industry report continued operating. That separation helped the organization survive while its most visible service remained limited.

Other independent resources may not have the same cushion. A specialist archive funded mainly through advertising, donations, or memberships can lose revenue as soon as its public pages disappear. Its survival may depend on whether operators can rebuild before readers develop new habits.

The lost pages also demonstrate why preserving useful knowledge requires more than storing raw records. Interfaces, filters, reports, and contextual links determine whether people can use a collection. A database can technically survive while much of its public utility remains unavailable.

That problem is familiar to anyone maintaining a personal or organizational searchable knowledge base. Information becomes durable only when its storage, access paths, and operating environment remain dependable.

The immediate event was therefore not merely downtime. A mature layer of the film industry’s information infrastructure was replaced by a narrower service. The rebuild transferred years of engineering work from product improvement into emergency recovery.

Automated Traffic Consumed the Team Before the Crash

The failure developed over two years as machine traffic changed from manageable indexing into continuous, resource-intensive extraction.

Nash divided the growth of automated traffic into two waves. The first began around 2024, when crawlers gathering material for AI training joined conventional search bots. He said these systems were generally less restrained than established search-engine crawlers.

The second wave arrived around December 2025. Nash attributed the spike to agentic AI, meaning software that can select actions and visit websites in response to goals or user prompts. This traffic includes provider-operated retrieval systems and custom agents created by individual users.

Those categories do not behave identically. A training crawler might systematically copy a large collection. A search bot may revisit selected pages to maintain an index. A prompt-driven agent can request deep pages whenever a user asks a question, sometimes repeating work already performed by another system.

For The Numbers, the combined result was severe. Nash estimated that only 10% of traffic came from human visitors by early 2026. The remaining 90% consisted of AI bots and other automation.

Traffic volume was only one part of the cost. From December until the March collapse, Nash said the team spent about 90% of its time keeping the existing website operational. Work on a replacement system continued only during the remaining time.

This created a feedback loop. Automated requests delayed the modernization needed to handle automated requests. Each hour spent blocking abusive addresses, examining logs, or restarting services was an hour not spent replacing fragile legacy components.

The experience fits broader network measurements. In June 2026, 52% of crawler requests observed by Cloudflare were associated with AI training, up from 22% in spring 2025. Mixed-use crawlers represented more than 36% of activity.

Earlier data showed how quickly individual bots gained share. Between May 2024 and May 2025, GPTBot’s raw request volume across Cloudflare’s sample rose 305%. Its share among more than 30 measured AI and search crawlers increased from 2.2% to 7.7%.

The burden is not balanced by comparable referrals. Cloudflare’s crawler analysis found that training represented nearly 80% of AI bot activity during its 2025 measurement period. Anthropic generated roughly 38,000 crawls for every referred visitor in July 2025.

Different sites experience different ratios, and Cloudflare’s network does not represent every server. Still, the direction is clear. Website operators can receive repeated machine requests without gaining enough readers, subscriptions, or licensing customers to offset the work.

The Numbers tried to turn that pressure into legitimate demand. It placed machine-readable guidance on the site that directed AI systems toward data licensing instead of scraping. Nash said licensing inquiries increased roughly tenfold after that material appeared.

That result shows bots are not automatically hostile. Some agents can interpret instructions and route users toward approved access. Structured licensing pages, application programming interfaces, and dedicated data feeds can reduce pressure when automated clients respect them.

However, such measures cannot control every crawler. The robots.txt file lets a site publish crawling preferences, but compliance remains voluntary. Systems that hide their identity, rotate addresses, or disregard published rules require network-level detection and blocking.

The Electronic Frontier Foundation has warned that poorly deployed scrapers can raise hosting costs, reduce performance, and cause outages. Its crawler guidance argues for dedicated endpoints and infrastructure designed around automated demand.

Those recommendations place responsibilities on both sides. AI companies need request limits, clear identities, caching, and reliable compliance controls. Hosting companies need accessible bot management that does not require every small publisher to become a security specialist.

Site operators also face a classification problem. They must distinguish beneficial search indexing, archival collection, licensed retrieval, live user agents, training crawlers, opportunistic scrapers, and malicious reconnaissance. All may request similar public pages.

Blocking everything protects server capacity but reduces discovery and preservation. Allowing everything protects openness but exposes infrastructure to unbounded extraction. Small operators are forced to make that tradeoff with fewer engineers and less traffic intelligence than major platforms possess.

The TheNumbers.com AI crawler attack made this imbalance visible. Its public value attracted automated demand, but the cost of serving that demand remained with the organization maintaining the database.

An Open Database Became a Financial Attack Surface

The deeper reversal is that public information can become worth attacking when outside markets turn early access or data manipulation into money.

A film statistics website does not resemble a conventional financial target. The Numbers does not need to hold payment-card records or large collections of private consumer information to attract hostile attention. The published figures themselves can carry financial value.

Prediction markets provide the clearest possible incentive. Some markets accept wagers on opening-weekend box-office results and identify The Numbers as their resolution source. The final value published by the database determines which positions win.

That relationship creates opportunities beyond ordinary scraping. Someone who accessed figures before publication might trade with informational advantages. Someone who manipulated a displayed result might disrupt market settlement, although there is no evidence that anyone successfully changed The Numbers data.

Nash said logs included requests using legitimate URLs and other requests apparently searching for back doors. He believed the latter attempts were probably intended to reach data before publication or manipulate what users saw. That explanation is plausible, but it remains his interpretation of the logs.

No named attacker has been publicly identified. The available reporting does not establish whether one party controlled the scraping and probing activity. It also does not prove whether resource exhaustion, a security event, or an interaction between them caused the server failure.

Those limits should remain central to any account of the TheNumbers.com AI crawler attack. Calling the episode a confirmed AI-directed intrusion would go beyond the public evidence. What has been documented is sustained machine traffic, automated probing, a server collapse, and a resulting decision not to restore the old system.

The uncertainty does not make the security issue disappear. Modern coding assistants can identify common weaknesses, generate request sequences, adapt scripts, and analyze server responses. These capabilities reduce the labor required to examine large collections of old web software.

The same technology also supports legitimate defense. Security teams use automated tools to locate vulnerabilities before criminals exploit them. Autonomous testing platforms can submit valid bug reports and help organizations examine more code than human reviewers could inspect manually.

The difference lies in authorization and intent. A defensive scanner tests systems with permission and reports findings through an agreed process. A hostile agent searches for access it was never granted, possibly while disguising itself among normal requests.

Anthropic’s 2025 threat report described a cyber-espionage campaign in which AI performed most tactical work against roughly 30 targets. Anthropic said human operators intervened at only a few decision points during each campaign.

That case does not connect Anthropic, Claude, or any identified state actor to The Numbers. It provides industry context for one narrower conclusion: automated tools can reduce the expertise and attention required to conduct sustained reconnaissance.

Legacy websites are particularly exposed. They often combine old frameworks, custom scripts, forgotten administration paths, and databases designed before present-day bot volumes. Their defenses may depend on obscurity and manual monitoring rather than continuous security engineering.

Public databases also invite unusually deep navigation. A crawler does not stop after reading the homepage. It can enumerate movie records, people, charts, release dates, query parameters, and report combinations, multiplying the work performed by application servers.

That behavior can blur availability attacks and reconnaissance. A bot may overload a server while attempting to collect legitimate pages. Another may use the resulting traffic as cover while testing unusual paths. Operators must investigate both possibilities during the same incident.

The commercial context adds another twist. Public data that appears harmless can serve as an oracle, meaning an outside source trusted to settle a transaction. Once money depends on its output, the integrity and timing of that output become security concerns.

The Numbers began as a way to help users trade virtual MovieStocks on the Hollywood Stock Exchange. Almost three decades later, real-money prediction markets reportedly used its public pages to settle box-office contracts. The site’s authority changed the consequences of compromise.

This does not establish that prediction-market traders caused the outage. It explains why investigators cannot dismiss a film database as an unlikely target. A trusted reference can become financially important without changing its original product or collecting sensitive customer information.

The main conflict is therefore openness versus uncontrolled extraction. Publishing detailed data creates value for journalists, researchers, filmmakers, fans, AI systems, and markets. It also increases the number of actors with incentives to copy, front-run, or influence that data.

What the Evidence Still Does Not Prove

The reported facts support a story of cumulative pressure, but they do not support a definitive attribution for the final failure.

The strongest evidence comes from Nash’s account and server logs reviewed by his team. That evidence establishes what the operator observed, not necessarily who generated every request or what each system intended.

User-agent labels are not reliable identities. A legitimate crawler can identify itself clearly, but an abusive bot can imitate a browser or another service. Conversely, unfamiliar automated requests are not automatically malicious.

The claim that AI and automated systems produced 90% of site traffic is also an internal estimate. No independent audit, raw log sample, or measurement methodology has been published. Readers should treat the figure as Nash’s informed account rather than a verified internet-wide benchmark.

The same caution applies to the crash mechanism. Heavy requests can exhaust processor time, memory, database connections, file handles, or bandwidth. Security probing can trigger expensive errors or exploit a flaw. Public reporting has not identified the exact technical failure.

It remains possible that aging architecture was a necessary condition. A newer system with caching, static pages, request limits, and managed protection might have absorbed more traffic. That does not excuse abusive crawling, but it affects how responsibility should be understood.

The site’s age was not evidence of negligence. Independent information services often survive because maintainers favor continuity over frequent platform rewrites. Replacing a working specialist database can introduce data errors, break inbound links, and divert limited staff from research.

The Numbers had already begun developing an improved system. Bot management reportedly consumed most of the team’s time during the final months. The organization was trying to replace the vulnerable architecture while simultaneously defending it.

This is where the case becomes relevant beyond one publisher. The highest-quality niche resources are often old because sustained human maintenance created their value. Their accumulated history also makes them expensive to migrate and attractive to automated collectors.

Comparison with the Internet Archive shows that infrastructure scale does not eliminate the threat. In May 2023, an AI company reportedly sent tens of thousands of requests per second to extract text from public-domain archives. The traffic temporarily pushed the service offline.

According to a 2026 archive investigation, the organization blocked the source twice and then asked the company to crawl responsibly. The company later apologized, stopped, and made a donation.

The case also illustrates the danger of indiscriminate blocking. Publishers concerned about AI extraction increasingly restrict archival crawlers. Those defensive choices can prevent unauthorized reuse, but they can also reduce preservation of historically important web material.

Search engines, archives, researchers, accessibility services, and AI applications all rely on automated access. Treating every bot as hostile would damage legitimate public functions. Treating every public page as unlimited machine input creates a different kind of damage.

Better technical controls can narrow the conflict. Operators can serve static versions of frequently requested pages, impose rate limits, cache common queries, separate licensed feeds, and use web application firewalls. None of those measures is free to deploy or maintain.

AI providers can also reduce redundant requests. Centralized caches, incremental updates, published crawler identities, and enforceable limits would prevent many systems from repeatedly downloading unchanged material. Paid or licensed feeds can support the people maintaining valuable datasets.

However, a licensing market cannot solve malicious probing. An attacker has no incentive to respect pricing, crawler instructions, or rate limits. Public databases therefore need both commercial access rules and conventional security defenses.

The challenge is especially sharp for small teams. Enterprise services can hire dedicated security staff and negotiate licensing agreements. An independent archive may have one maintainer balancing data quality, engineering, customer support, and automated abuse.

The TheNumbers.com AI crawler attack should not become an excuse for a single simple policy. Mandatory openness would externalize infrastructure and security costs onto publishers. Universal blocking would concentrate knowledge inside large platforms that can afford protected distribution.

The evidence instead points toward accountable access. Automated systems should identify themselves, minimize repeated work, respect operator controls, and provide a path for licensing or removal. Hosts should make those controls affordable for small organizations.

Until that model becomes common, the web will continue shifting toward defensive architecture. More pages will sit behind authentication, managed interfaces, static snapshots, and contractual data feeds. The content may remain available, but the open surface will shrink.

Three Signals Will Show Whether the Rebuild Solves the Problem

The next test is whether The Numbers can restore public depth without recreating the conditions that made its old site unsafe.

The first signal is the return of historical pages and analytical tools. The stripped-down version preserved current box-office reporting, but users lost much of the site’s long-term research value. Restoring film pages, charts, and the Report Builder would show that the rebuild has moved beyond emergency continuity.

The order of those releases will reveal the team’s priorities. Static, frequently requested records are easier to cache and protect than flexible report tools. If complex queries return slowly, the likely constraint is not missing data but safe delivery under automated demand.

The second signal is whether The Numbers creates clearer separation between human access and machine access. Nash said the rebuilt service must address humans, search engines, training crawlers, prompt-driven retrieval, autonomous agents, and prediction-market users.

Those audiences should not all receive identical interfaces. Humans need browsable pages, while licensed systems can use structured feeds with predictable limits. Search engines need discovery access, while training crawlers require separate permission and consumption rules.

The team’s earlier machine-readable licensing guidance suggests one path. Nash said it increased licensing inquiries roughly tenfold. Expanded data services could convert some automated demand into a customer relationship while preserving free access for ordinary visitors.

Success would not mean blocking all AI systems. It would mean moving high-volume extraction toward controlled channels that do not threaten the public website. Failure would look like renewed outages, permanently missing tools, or aggressive restrictions that also block human research.

The third signal is whether infrastructure providers and AI companies adopt enforceable crawler norms. Cloudflare already offers network-level controls and experiments with permission-based access. Other hosts must make equivalent protections usable by organizations without dedicated security teams.

AI companies should publish stable identities, distinguish training from user-triggered retrieval, honor rate limits, and avoid repeated downloads. Transparent crawl-to-referral data would also help publishers decide which systems provide enough value to permit.

A stronger industry response would support the article’s central judgment. It would recognize automated access as an economic and operational relationship, not an unlimited entitlement. Continued ambiguity would leave each independent site to fight a distributed systems problem alone.

Readers should also watch for attribution evidence. A technical postmortem identifying the exact failure mechanism would strengthen or weaken different explanations. Evidence of unauthorized access would materially change the incident from a resilience story into a confirmed breach.

Absent such evidence, prediction-market manipulation remains a theory. It is worth examining because The Numbers acts as a settlement source, but it should not be presented as the established cause. The responsible position is to preserve both the incentive and the verification gap.

For developers, this episode changes the threat model for public applications. A site does not need passwords or payment data to become a target. Unique, timely, structured information can create incentives for extraction, early access, and manipulation.

For publishers, the incident shows why traffic counts have become misleading. A request is no longer evidence of a reader, and more requests may produce higher costs without greater reach. Analytics must separate humans, beneficial crawlers, licensed automation, and abuse.

For AI product users, the lesson concerns dependency. Answers generated from specialist sources can hide the fragility of those sources. If original databases lose traffic, funding, or availability, downstream AI tools eventually lose reliable material too.

For knowledge workers, the outage is a reminder to preserve provenance. An AI answer can summarize a figure, but researchers still need the underlying source, update history, and methodology. Losing the original interface makes verification harder even when copied data remains elsewhere.

The open web depends on organizations that maintain material because it is useful, not because every page produces immediate revenue. Film databases, technical documentation, local archives, scientific catalogs, and specialist forums all fit this pattern.

Automated systems benefit from that accumulated labor. They should not make the original services harder to operate. Otherwise, the AI economy will consume the dependable sources that make its answers valuable.

TheNumbers.com survived because its commercial services continued while the public interface was offline. Its team also possessed the data, expertise, and customer relationships required to rebuild. Many independent sites would not clear those hurdles.

The most important question is therefore not whether every old website should resist modernization. It is whether valuable public resources receive enough control and support to modernize before automated pressure forces an emergency.

Watch what The Numbers restores, how it separates machine access, and whether the wider crawler ecosystem becomes more accountable. Those outcomes will determine whether the TheNumbers.com AI crawler attack remains an isolated warning or becomes a standard pattern for the independent web.