Act this weekWhat happenedArchive of Our Own went offline Thursday after its owner found evidence of a security incident, and it cannot rule out that user data was stolen.
Who is affectedAnyone with an AO3 account, among more than 11 million registered users, plus readers of its 18 million-plus fan works.
What to do- 1Change your password on any other site where you use the same one as AO3.
- 2Pick a new, unique password for each account, ideally with a password manager.
- 3Watch your email for odd messages or login alerts, and do not click suspicious links.
- 4Check AO3's official updates for news, and expect the site to be limited or down again.
Archive of Our Own, the fan fiction site known as AO3, went offline Thursday, and it may be weeks before it fully returns. Its owner first called it maintenance. Later updates said it had found evidence of a security incident and could not rule out that user information was stolen.
What happened
The nonprofit behind AO3, the Organization for Transformative Works, says restoring the site could take at least two weeks and possibly four. It says it is still in the early stages of investigating how far the incident reached.
The site may come back in a limited form, with some features missing or in read-only mode, meaning people can read but not post. The nonprofit warns it might have to take the site down again without notice while it works on recovery.
Why it matters
AO3 says its user database holds usernames, email addresses, IP addresses and hashed passwords. An IP address is a number that can point to your internet connection. A hashed password is a scrambled version of the real one, not the password itself.
The risk is reuse. If you use the same password on AO3 and somewhere else, such as email or shopping, anyone who gets that password could try it on those other accounts. That is why the nonprofit told users to change reused passwords elsewhere.
Who can relax a little
The nonprofit says no AO3 data was deleted. Stories, bookmarks and other content are still there. The site hosts more than 18 million works, and the warning is about the user database, which covers its more than 11 million registered users as of this summer.
What to do
The alert box above lists the steps. The most urgent is changing any password you share with AO3. After that, stay alert for odd emails or login notices, since an email address is one of the details that may be exposed.
What happens next
It is not yet known whether any data was actually taken, who was behind the incident, or exactly when the site will be back. The nonprofit says it will post more information as its investigation goes on, so its official updates are the place to check.
The takeawayIf you have an AO3 account, change any password you also use elsewhere, and check the site's official updates for news.