# AO3 (Archive of Our Own) down for 2-4 weeks after security incident; user database theft not ruled out · pwn.watch > The Organization for Transformative Works (OTW) took Archive of Our Own (AO3), the large fan-fiction site, offline on Oct 29 for what it first called maintenance, then said it had detected evidence of a security incident. OTW says no AO3 data was deleted and it does not currently believe the user database was stolen, but cannot rule it out. That database may hold usernames, email addresses, IP addresses and hashed passwords. AO3 does not collect real names, and donor data is in a separate system that was not exposed. The site is expected to stay down for at least two weeks and up to four. Page: https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026 · generated 2026-10-30T05:37:51.190Z ## Status - Severity: medium · status: live · patch: partial - Product: Archive of Our Own (archiveofourown.org) - Started: 2026-10-29 - Affected: AO3 accounts (usernames, email addresses, IP addresses, hashed passwords) if the user database was taken - Fixed in: AO3 offline while OTW investigates; service restoration expected in 2 to 4 weeks, possibly in a degraded or read-only state first ## Follow this incident - RSS (one item per update): https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026.json - This file: https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30: At 01:27 UTC OTW says it detected evidence of a security incident on AO3. No data was deleted; it does not believe the user database was stolen but cannot rule it out, and recommends changing any passwords reused from AO3 on other sites. (https://status.archiveofourown.org/) - 2026-10-29: AO3 goes down at 07:13 UTC for what OTW calls maintenance, expected to take at least 12 hours. At 17:41 UTC OTW says restoration will take around 2 weeks and possibly up to 4. (https://status.archiveofourown.org/) ## Fix brief # Security brief: AO3 (Archive of Our Own) down for 2-4 weeks after security incident; user database theft not ruled out Source: https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026 · status: live · severity: medium · updated Oct 30, 2026, 02:58 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is The Organization for Transformative Works (OTW) took Archive of Our Own (AO3), the large fan-fiction site, offline on Oct 29 for what it first called maintenance, then said it had detected evidence of a security incident. OTW says no AO3 data was deleted and it does not currently believe the user database was stolen, but cannot rule it out. That database may hold usernames, email addresses, IP addresses and hashed passwords. AO3 does not collect real names, and donor data is in a separate system that was not exposed. The site is expected to stay down for at least two weeks and up to four. Severity detail: Very large user base; possible theft of usernames, emails, IPs and hashed passwords is not ruled out, but no confirmed exfiltration and no real names or donor data stored - Product: Archive of Our Own (archiveofourown.org) ## Affected versions - AO3 accounts (usernames, email addresses, IP addresses, hashed passwords) if the user database was taken ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - AO3 offline while OTW investigates; service restoration expected in 2 to 4 weeks, possibly in a degraded or read-only state first After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you have an AO3 account, change that password on any other site where you reused it, and watch for phishing that uses your AO3 email. There is nothing to patch on your side; wait for OTW's updates on the status page before logging back in. ## Latest updates - Oct 30, 2026: At 01:27 UTC OTW says it detected evidence of a security incident on AO3. No data was deleted; it does not believe the user database was stolen but cannot rule it out, and recommends changing any passwords reused from AO3 on other sites. - Oct 29, 2026: AO3 goes down at 07:13 UTC for what OTW calls maintenance, expected to take at least 12 hours. At 17:41 UTC OTW says restoration will take around 2 weeks and possibly up to 4. ## Advisories - [AO3 Down for Maintenance (status page updates)](https://status.archiveofourown.org/) (Organization for Transformative Works) ## Write-ups & news - [Fan-fiction site Archive of Our Own (AO3) could be offline for up to 4 weeks after security incident](https://techcrunch.com/2026/10/29/fan-fiction-site-archive-of-our-own-could-be-offline-for-up-to-4-weeks/) - [Fan fiction website AO3 is down, and it could take weeks to recover](https://www.engadget.com/2301753/ao3-fanfiction-website-down-for-weeks/) --- Machine-readable: https://pwn.watch/i/ao3-archive-of-our-own-security-incident-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.