Archive of Our Own, the fan-fiction library better known as AO3, has been offline since late October after its operators said they found evidence of a security incident. The Organization for Transformative Works (OTW), the nonprofit that runs the site, told users to expect an outage of at least two weeks and possibly four. If you searched “Archive of Our Own down” this week, that is the answer: this is not a routine maintenance window, and the site is not coming back tonight.
The OTW says it does not currently believe the user database was stolen, but it cannot rule that out. The data at risk includes usernames, email addresses, IP addresses and hashed passwords, according to coverage from TechCrunch, Gizmodo, IBTimes and The Express Tribune. Stories, bookmarks and kudos were not deleted. This is the same week our readers watched the Warhorse hack unfold with five facts confirmed and four unknown, and the AO3 case follows the same pattern: a short statement, a long list of open questions.
This analysis walks through what the OTW has actually said, what the reports add, which parts of the story remain unconfirmed, and what AO3 users should do today. We also look at what a multi-week outage means for a platform that millions of people treat as infrastructure for their hobby.
Why Is Archive of Our Own Down? The Short Answer
AO3 is down because the OTW detected evidence of a security incident and pulled the site offline while it investigates and recovers. The organization describes itself as still in the early stages of that response. It has not published a root cause, an attacker, or a count of affected accounts.
The first public notice did not call it a security event. According to IBTimes, the OTW announced maintenance early on October 29, then stretched the estimate, then rewrote it into a two-to-four-week outage before disclosing the security angle in the early hours of October 30 UTC. The OTW’s own update, titled “Update on AO3 Downtime, October 30, 2026,” carries the later date, while TechCrunch published its report on October 29. That date spread reflects a fast-moving status page rather than a contradiction in the facts.
For readers who just want the practical takeaway, three points matter. First, your works and bookmarks are reported safe. Second, if you reused your AO3 password anywhere else, change it on those other sites. Third, do not expect a firm reopening date, because the OTW has not given one.
What the OTW Has Confirmed So Far
The OTW statement is short, and every outlet we checked reports the same core points. The organization says it detected evidence of a security incident on AO3. It says it is still determining the scope. It says the site will stay down while the team investigates and fixes what it has found so far.
On the user database, the wording is careful. The OTW says it does not currently believe the database was stolen, yet it cannot confirm that access was prevented. That distinction matters. “We don’t think data left the building” and “nobody got in” are different claims, and the OTW is only making the first.
IBTimes reports the OTW’s recovery estimate as a floor of two weeks with a ceiling of four. TechCrunch and Gizmodo both add that the team may bring AO3 back sooner in a degraded state, with limited features or read-only access, and that further unplanned offline periods could follow during recovery.
One more confirmed detail comes from TechCrunch. The outage is not tied to the recent PHP vulnerabilities making headlines, because AO3 runs on Ruby on Rails rather than PHP. TechCrunch also reported that the OTW did not respond to its request for comment. We reached the same dead end: the public record is the OTW’s own posts and nothing more.
Timeline: From Maintenance Notice to Security Incident
The sequence below follows the timestamps reported by IBTimes. We attribute the times to that outlet because the OTW’s public statements do not repeat them in one place. Treat the table as a reported timeline, not an official incident log.
| Time (UTC) | Date | What was announced |
|---|---|---|
| 07:13 | October 29 | Maintenance announced on the status page |
| 09:03 | October 29 | Estimate stretched to 12+ hours of downtime |
| 17:41 | October 29 | Estimate revised to 2 to 4 weeks |
| 01:27 | October 30 | Security incident disclosed, with data-exposure guidance |
| Earlier | October 23-24 | Email and search delays noted on the status page, per IBTimes |
Two things stand out. The jump from “12+ hours” to “2 to 4 weeks” took under nine hours, which suggests the team learned something serious within the workday. And the security disclosure arrived roughly eight hours after that, which suggests the OTW chose to confirm the cause only once it had settled on what to tell users about their data.
We cannot say whether the October 23-24 delays relate to the incident. IBTimes lists them as earlier status-page entries and draws no link, and neither do we.
What Data Could Be Exposed
The OTW lists four categories of account data that may be present in the AO3 database: username, email address, IP address and a hashed version of the password. It adds that AO3 does not collect real names, so none could be exposed, and that donor information lives in a separate system with no link to AO3 accounts.
| Data type | Status per OTW and reports | Risk if exposed |
|---|---|---|
| Username | Possibly in database | Links a pen name to an account |
| Email address | Possibly in database | Phishing, and a link to real identity |
| IP address | Possibly in database | Rough location, and a possible identity link |
| Hashed password | Possibly in database | Offline cracking, then reuse elsewhere |
| Real names | Not collected | None from AO3 |
| Donor information | Separate system, not exposed | None reported |
| Works, bookmarks, kudos | Not deleted | No loss reported |
The third column is our analysis, not OTW language. It shows why the email and IP fields worry privacy-minded fans more than the password hash does. Many AO3 users write under pen names precisely because their fandom activity is separate from their working lives. A leaked email address is the most direct bridge between those two identities.
Why a Hashed Password Is Not the Same as a Safe One
TechCrunch reports that AO3 passwords use industry-standard hashing. That is good news. A hash turns a password into a fixed string that cannot be reversed by simple means, so an attacker holding a stolen database does not instantly see anyone’s password.
The Express Tribune adds the caveat that matters: weak or reused passwords stay vulnerable to cracking even when the hashing is sound. Attackers do not reverse hashes. They guess candidate passwords, hash each guess, and compare. A slow, well-built hashing scheme makes each guess expensive, but a password like a common word or a short pattern still falls quickly because the attacker tries the likeliest guesses first.
That is why the OTW’s single piece of user advice is about other sites. If your AO3 password also unlocks an email account, a social network or a shopping login, a cracked hash turns one incident into several. Security teams call the follow-on attack credential stuffing, and it works because people recycle passwords. We covered the identity side of this problem in our look at the DHS leak that put single sign-on under scrutiny, where the lesson was the same: one weak link spreads across accounts.
What AO3 Users Should Do Right Now
The OTW asks for one action. We think a few more are cheap and sensible while the investigation runs. Here is the list, with the OTW’s own request first.
- Change the password on any other site where you used the same password as on AO3. This is the OTW’s explicit recommendation.
- Switch those accounts to unique passwords, ideally generated by a password manager, so one leak cannot cascade.
- Turn on two-factor authentication on your email account first, because email is the key to every password reset.
- Treat unexpected emails that mention AO3, a “data breach” or a “password reset” as suspect. Attackers love a news cycle.
- Check official OTW channels for updates rather than screenshots passed around on social media.
If you reused your AO3 password
Start with email, then banking and shopping, then social accounts. Do the accounts that can reset other accounts first. Do not wait for confirmation that the database was stolen, because the OTW itself says it cannot rule that out.
If you already use a password manager
You are in better shape than most. Confirm your AO3 entry is unique, and update it once the site returns. If you are weighing options, our walkthrough on setting up a self-hosted Bitwarden vault with passkeys covers one route that keeps the vault under your control.
Who Runs AO3 and How Many People Rely on It
The OTW is a nonprofit, and TechCrunch notes that it depends on volunteers and donations. Gizmodo reports that AO3 launched in 2008, hosts more than 18 million fanworks, and had more than 11 million registered users as of summer 2026. We use those figures as Gizmodo’s, since the OTW did not repeat them in its incident post.
Those numbers frame the stakes. A site with that much content and that many accounts carries a security burden normally associated with a commercial platform, yet the OTW funds it through donations and runs much of it with unpaid staff. That is not a criticism of the team. It is context for why an incident response can take weeks rather than days.
TechCrunch also reported that status-page posts about the outage gathered millions of views across social media within two hours. That reach shows how much of fandom treats AO3 as shared infrastructure. Writers host years of work there. Readers keep reading lists there. Moderators, tag wranglers and translators build workflows around it.
Reading the Two-to-Four-Week Estimate
An outage that long usually signals more than a patch and a restart. We cannot say what the OTW is doing behind the scenes, and it has not published details. But general incident-response practice offers a rough guide to what weeks of downtime typically cover.
Teams first contain the problem and preserve evidence. They then work out how an attacker got in and what they touched. They rebuild or harden affected systems, rotate secrets, and verify that backups are clean before bringing anything back. For a large database-driven site, validating data integrity alone can eat days. Our reading, labeled as analysis rather than reporting, is that the OTW chose a conservative window so it would not have to announce a delay later.
The mention of a possible degraded or read-only return fits that picture. Read-only mode lets the team restore access to stored works without accepting new logins, comments or uploads, which shrinks the attack surface while the rebuild continues.
How AO3 Compares With Other October 2026 Incidents
Gizmodo places the AO3 outage inside a rough month for security news, including the PHP vulnerabilities and the DHS employee data leak. The table sets AO3 beside three incidents we have covered this month. Counts come from our earlier headlines and are not directly comparable, since each organization discloses on its own terms.
| Incident | Count disclosed | Disclosure status | Our coverage |
|---|---|---|---|
| AO3 (OTW) | None | Scope still being determined | This article |
| Sony So-net | 2,585,481 records | Specific count published | So-net breach report |
| DHS Icepick leak | About 41,000 records | Records posted publicly | Icepick leak report |
| Warhorse | None | 5 facts confirmed, 4 unknown | Linked above |
AO3 sits at the thin-disclosure end. That is normal for day one of an investigation. Sony So-net, by contrast, published a concrete record count. The difference tells readers what kind of update to expect: a number from AO3 will arrive only after the team finishes its forensic work.
Historical Context: Volunteer-Run Platforms Under Pressure
AO3 has operated since 2008 as a nonprofit alternative to ad-funded fan-fiction hosts. Its model leans on donations, volunteer developers and community goodwill. TechCrunch says that structure is intact, and the OTW’s statement keeps the usual tone of a community organization talking to its members rather than a vendor issuing a press release.
That model has strengths. It keeps the site free of ads and trackers, and it gives users a voice. It also means security work competes with every other need for scarce volunteer hours. We found no earlier security incident at AO3 in the reports we reviewed. TechCrunch states that its article contains no reference to previous events, so we make no claim about the site’s past record.
The wider pattern is easy to see in our own archive. Several incidents this fall, from the PHP2Shell and Fragnesia server compromises to the DHS leak, show attackers working across sectors at once. A volunteer-run site gets no exemption from that pressure.
Community and Market Impact
AO3 does not sell anything, so there is no stock to move and no revenue line to dent. The impact lands on people. Gizmodo captured the mood with fan posts joking about a “total psychological collapse,” and IBTimes reports that users are drifting to alternatives such as Wattpad, FanFiction, Reddit and the Wayback Machine to read and share work in the meantime.
Writers face a different problem. Many keep their only copy of long works on AO3. The OTW says nothing was deleted, which should ease the worst fear, but a writer with no local backup is still locked out of their own archive for weeks. We expect this outage to push many authors toward keeping offline copies, which is the sort of habit that outlasts the incident.
Competing platforms may see a traffic bump. Whether that sticks after AO3 returns is an open question, because AO3’s tagging system, archive depth and nonprofit status are hard to replicate. The more probable effect is a temporary spread of readers across several services.
Predictions: What Happens Next
These are our assessments, not reported facts, and we have tried to keep them tied to what the OTW has already said.
- A read-only return comes first. The OTW has already floated a degraded state, so we expect browsing to come back before accounts, uploads and comments do.
- The OTW publishes a fuller account later. Community nonprofits tend to explain themselves once the facts are settled. We expect a post-incident write-up after the site stabilizes, though the OTW has not promised one.
- The scope statement changes. The current line says the database was probably not stolen. Forensics could confirm that or reverse it, and either outcome will trigger a new round of user guidance.
- Phishing follows the headlines. Fake “reset your AO3 password” emails are a likely side effect of any publicized outage. Users should go to the site directly rather than click links in messages.
- Offline backups become a fandom habit. Expect writers’ communities to circulate export-and-backup advice well beyond this month.
What We Still Do Not Know
The list of open questions is longer than the list of answers. The OTW has not said how the intruder got in, whether the attacker is known, or whether any data actually left the network. It has not given a number of potentially affected accounts, and it has not named a reopening date.
We also cannot confirm the cause of the October 23-24 delays, and nothing we reviewed ties them to the incident. Since the OTW did not respond to TechCrunch’s request for comment, outside reporters have nothing beyond the status posts. We will update this article if the OTW publishes new details.
For broader context on how organizations handle incidents like this one, browse our cybersecurity coverage, where we track breaches, zero-days and compliance fallout week by week.
FAQ: Archive of Our Own Outage
Why is Archive of Our Own down?
The OTW detected evidence of a security incident and took AO3 offline to investigate and recover. It says it is still in the early stages of determining the scope.
How long will AO3 be down?
The OTW expects at least two weeks and says it could take up to four. The site may return sooner in a degraded or read-only state.
Was my data stolen?
The OTW does not currently believe the user database was stolen, but it cannot rule it out. Potentially affected data includes usernames, email addresses, IP addresses and hashed passwords.
Were any fanworks deleted?
No. The OTW says nothing has been deleted, and that works, bookmarks and kudos are safe.
Does AO3 store real names or payment details?
AO3 does not collect real names. Donor information sits in a separate system that the OTW says is not linked to AO3 accounts and was not exposed.
Do I need to change my AO3 password?
The OTW’s advice is to change passwords on any other site where you used the same password as on AO3. Changing the AO3 password itself can wait until the site returns.
Is this linked to the recent PHP vulnerabilities?
TechCrunch reports it is not, since AO3 runs on Ruby on Rails rather than PHP. The OTW itself has not named a cause.