AO3 (Archive of Our Own) down for 2-4 weeks after security incident; user database theft not ruled out
Archive of Our Own (archiveofourown.org)
The Organization for Transformative Works (OTW) took Archive of Our Own (AO3), the large fan-fiction site, offline on Oct 29 for what it first called maintenance, then said it had detected evidence of a security incident. OTW says no AO3 data was deleted and it does not currently believe the user database was stolen, but cannot rule it out. That database may hold usernames, email addresses, IP addresses and hashed passwords. AO3 does not collect real names, and donor data is in a separate system that was not exposed. The site is expected to stay down for at least two weeks and up to four.
Why this severity: Very large user base; possible theft of usernames, emails, IPs and hashed passwords is not ruled out, but no confirmed exfiltration and no real names or donor data stored
- Started
- Oct 29, 2026
Affected
- AO3 accounts (usernames, email addresses, IP addresses, hashed passwords) if the user database was taken
Fixed in
- AO3 offline while OTW investigates; service restoration expected in 2 to 4 weeks, possibly in a degraded or read-only state first
Timeline2
At 01:27 UTC OTW says it detected evidence of a security incident on AO3. No data was deleted; it does not believe the user database was stolen but cannot rule it out, and recommends changing any passwords reused from AO3 on other sites.
AO3 goes down at 07:13 UTC for what OTW calls maintenance, expected to take at least 12 hours. At 17:41 UTC OTW says restoration will take around 2 weeks and possibly up to 4.
Advisories1
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
