1. News
  2. Alerts
  3. AO3 · Data breach
AlertAO3 · Data breach2 min read

Fan fiction site AO3 is down for weeks after a security incident

AO3 went offline after a security incident and may stay limited for up to four weeks. Account holders should treat their email and login details as possibly exposed.

By the Dashline deskSource: Techmeme
Fan fiction site AO3 is down for weeks after a security incident
Photo: Victorgrigas, CC BY-SA 3.0
Act this week
What happenedArchive of Our Own went offline Thursday after its owner found evidence of a security incident, and it cannot rule out that user data was stolen.
Who is affectedAnyone with an AO3 account, among more than 11 million registered users, plus readers of its 18 million-plus fan works.
What to do
  1. 1Change your password on any other site where you use the same one as AO3.
  2. 2Pick a new, unique password for each account, ideally with a password manager.
  3. 3Watch your email for odd messages or login alerts, and do not click suspicious links.
  4. 4Check AO3's official updates for news, and expect the site to be limited or down again.

Archive of Our Own, the fan fiction site known as AO3, went offline Thursday, and it may be weeks before it fully returns. Its owner first called it maintenance. Later updates said it had found evidence of a security incident and could not rule out that user information was stolen.

What happened

The nonprofit behind AO3, the Organization for Transformative Works, says restoring the site could take at least two weeks and possibly four. It says it is still in the early stages of investigating how far the incident reached.

The site may come back in a limited form, with some features missing or in read-only mode, meaning people can read but not post. The nonprofit warns it might have to take the site down again without notice while it works on recovery.

Why it matters

AO3 says its user database holds usernames, email addresses, IP addresses and hashed passwords. An IP address is a number that can point to your internet connection. A hashed password is a scrambled version of the real one, not the password itself.

The risk is reuse. If you use the same password on AO3 and somewhere else, such as email or shopping, anyone who gets that password could try it on those other accounts. That is why the nonprofit told users to change reused passwords elsewhere.

Who can relax a little

The nonprofit says no AO3 data was deleted. Stories, bookmarks and other content are still there. The site hosts more than 18 million works, and the warning is about the user database, which covers its more than 11 million registered users as of this summer.

What to do

The alert box above lists the steps. The most urgent is changing any password you share with AO3. After that, stay alert for odd emails or login notices, since an email address is one of the details that may be exposed.

What happens next

It is not yet known whether any data was actually taken, who was behind the incident, or exactly when the site will be back. The nonprofit says it will post more information as its investigation goes on, so its official updates are the place to check.

The takeaway

If you have an AO3 account, change any password you also use elsewhere, and check the site's official updates for news.

More articles

You should really read these.

Next step

Let’s talk