The AO3 down notice first described routine maintenance. Archive of Our Own, the fan-fiction archive run by the nonprofit Organization for Transformative Works (OTW), went offline on Oct. 29. Later updates said the nonprofit had found evidence of a security incident that may have exposed account data, and restoration is now estimated at two to four weeks.
The timing is messy. According to IBTimes UK, the security disclosure came at 01:27 UTC on Oct. 30, which is late on Oct. 29 Eastern time. Other outlets date the initial outage to Thursday, Oct. 29, and the site remained offline on Saturday, Oct. 31.
AO3 hosts more than 18 million works and has more than 11 million users, according to The A.V. Club. That scale explains why an outage of this length has drawn so much attention, and why the password advice reaches far beyond people who post stories.
What OTW says was exposed
OTW told TechCrunch that it had detected evidence of a security incident and was in the early stages of responding and determining its scope. The nonprofit said the user database may hold four kinds of data: usernames, email addresses, IP addresses and a hashed version of each password.
A hash is a scrambled form of a password, not the password itself. AO3 uses an industry-standard hashing method, but no hashing method can fully protect a weak or reused password from being cracked. Anyone who holds a copy of hashed passwords can guess at them offline, on hardware they control, which is why this kind of exposure is serious even when the hashing is good.
OTW says it does not currently believe the user database was stolen. The same statement, as TechCrunch quoted it, adds: "we are also unable to rule it out." That gap between not believing and not being able to rule out is the central uncertainty here.
Some details are reassuring. According to the nonprofit, no stories, bookmarks or other content have been deleted. Donor information is kept separately from AO3, and the team says donor data is not linked to the archive and was not affected, as Tribune reported.
The model behind the site also matters. AO3 is a project of a nonprofit that relies on volunteers and donations, and that same organization is now deciding how much detail to share and when.
Should you change your AO3 password
If you have an AO3 account, the advice is simple, and it does not depend on how the investigation ends. OTW told users to change their AO3 password and to change it on any other site where they used the same one. Here is the practical checklist:
- Change your AO3 password once you can reach your account. If you cannot log in while the site is down, change the password on every other site where you reused it first.
- Use a unique password for each account, ideally one generated and stored by a password manager, as Tech-Insider recommends.
- Treat any "reset your password" email as suspicious. Go to the official AO3 status channel directly instead of clicking links in an email.
- Keep offline copies of your own works and bookmarks, since the archive may be unavailable for weeks.
Phishing is the next risk to watch. Tech-Insider notes that fake "reset your AO3 password" emails are a likely side effect of any publicized outage. That is analysis, not a confirmed campaign, but it makes every unexpected message worth a second look.
The 2012 LinkedIn breach shows why password reuse is the main follow-on risk. Russian cybercriminals stole passwords for nearly 6.5 million LinkedIn accounts that year, according to Wikipedia's account of the breach. A password taken from one site becomes a test for many others, which is why the advice centers on unique passwords.
How long AO3 could stay offline
OTW said AO3 would be down for at least two weeks and possibly up to four, according to IBTimes UK. An earlier return remains possible. When the site does come back, users may find missing features or a read-only version of the archive, and the nonprofit has not given a firm date.
| Date (2026) | What happened |
|---|---|
| Oct. 23 and 24 | A separate disruption affected email notifications, search and bookmark listings. OTW has not linked it to the security incident. |
| Oct. 24 | OTW marked that earlier problem resolved, saying the backlog had cleared and no data had been lost. |
| Oct. 29 | Outage begins, according to other outlets. The first notice described maintenance. |
| Oct. 30, 01:27 UTC | OTW discloses a security incident. |
| Oct. 31 | Site remains offline. |
Counting from the Oct. 29 start, the two- to four-week estimate points to a return between roughly Nov. 12 and Nov. 26. That is arithmetic on OTW's estimate, not a schedule the nonprofit has published.
What is still unknown
- Whether the database was stolen. OTW does not believe so but has not ruled it out.
- How the attack happened and who was behind it. OTW has not named a cause.
- The ransom claim. Tribune reported a demand of $30,000 from a group it did not name. That figure comes from a single outlet and is unverified.
- Any PHP connection. One report, from BigGo Finance, said Fanlore, another OTW site, was briefly taken down to address a PHP vulnerability. OTW has not said AO3 is dealing with a PHP flaw.
The dates also differ across reports. TechCrunch's story is dated Oct. 29, while OTW's formal statement is dated Oct. 30. The 01:27 UTC timestamp falls on the evening of Oct. 29 in Eastern time, so both dates can be right.
What to watch next
The next signal is whether OTW confirms theft. If it does, the advice may expand beyond passwords to watching for targeted phishing, and the nonprofit will need to say what was taken. If it does not, attention will shift to the restoration plan and whether the archive returns with its full feature set. The status channel is the place to watch, and any update that arrives by email or social post should be checked against it first.
Similar incidents show how long recovery can take. University Hospitals' MyChart portal has stayed down for about a week after a cyberattack, and Chainalysis has said hackers breached its systems and accessed customer data. Those cases suggest the first downtime estimate is a starting point, not a promise.
