AO3 Outage Tied to Security Incident; Archive of Our Own Urges Users to Change Reused Passwords

Archive of Our Own is still offline, and the reason is now clearer. Late Thursday night ET, the fan-fiction site said its shutdown is linked to a security incident, not just routine maintenance, and it told users to change any passwords they reuse elsewhere.

“Earlier today, we detected evidence of a security incident on AO3,” the site’s team wrote in an update posted to its official status channels, including Tumblr and Bluesky. “We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far.”

Why is AO3 down?

AO3 went offline early Thursday, Oct. 29, for what was described as maintenance expected to last at least 12 hours. Later that day, the site estimated that restoring service would take around two weeks and possibly up to four. The new update gives the reason: an ongoing response to a security incident.

AO3 has not said what kind of incident it was, how an attacker may have gotten in or when it began. TechCrunch noted that the site did not initially share details and only published the longer statement hours after announcing the multiweek outage.

Was AO3 user data stolen?

AO3 says it does not know yet. Its statement made several points clear:

• Works are safe: “No AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.”
• User data can’t be ruled out: “While we currently don’t believe that the user database was stolen, we are also unable to rule it out.”
• What the database holds: account information that “may include your username, email address, IP address, and a hashed version of your password.”
• No real names: AO3 does not collect real names, so none could be exposed.
• Donors are separate: donor information is kept in an entirely separate system that is never linked to AO3, so that data was not exposed, the site said.

Should I change my AO3 password?

AO3’s advice is aimed at other accounts. The site said it stores passwords using industry-standard hashing, a scrambled form that is hard to reverse, but “no hashing method can fully protect a weak or reused password from being cracked.” As a precaution, it recommends changing your password on any other site where you used the same password as on AO3.

AO3 itself is offline, so there is no way to change the password on the archive right now.

Is AO3 down right now, and when will it be back?

Yes. AO3 now says it expects to be down for a minimum of two weeks and possibly up to four. It may be able to bring the site back sooner in a “degraded state,” meaning some features could be missing or the site could be read-only, and it warned it might have to take the site down again unexpectedly during recovery.

The site said it may be unable to answer individual questions and pointed users to its official outlets for updates.

Why it matters

AO3 is run by the Organization for Transformative Works, a nonprofit that relies on volunteers and donations, TechCrunch noted. Engadget pointed out that the OTW’s engineers are volunteers rather than paid staff, which could slow fixes. The site’s community is huge and vocal: within two hours of the outage announcement, its status posts had drawn millions of views across social media, according to TechCrunch.

FAQ

Earlier coverage: Is AO3 Down? Archive of Our Own Says Restoration Could Take 2 to 4 Weeks (Oct 29)