Act this weekWhat happenedAO3 went offline after the site detected a security incident, and it expects a two to four week recovery.
Who is affectedAnyone with an AO3 account, whose username, email, IP address and hashed password may be in the database.
What to do- 1Change your password on any other site where you used your AO3 password.
- 2Use a different, unique password for each account from now on.
- 3Be wary of emails that claim to be from AO3 and ask for your login.
- 4Check the AO3 status page for official updates.
Archive of Our Own, the fan-fiction site known as AO3, has gone offline and could stay down for two to four weeks. The site first went dark for what was meant to be routine overnight maintenance. Later it said it had found evidence of a security incident.
Who it affects
Anyone with an AO3 account. The site says it does not currently believe the user database was stolen, but it cannot rule that out. The database holds usernames, email addresses, IP addresses and hashed passwords. A hashed password is a scrambled version of the real one, which makes it harder to read if stolen. AO3 says it uses an industry-standard method.
The main risk is reuse. If your AO3 password is the same one you use elsewhere, that other account is the one to protect. The steps in the alert box above cover what to do.
What is not known yet
AO3 says it is still in the early stages of its response and is working out the scope. It has not said what caused the incident. The site is run by the nonprofit Organization for Transformative Works, using volunteers and donations. It did not reply to TechCrunch's requests for comment.
Some fans linked the outage to last week's flaws in PHP, a programming language behind about 70% of the internet. AO3 is built on a different toolkit, Ruby on Rails, so a connection is unlikely.
What happens next
AO3 estimates about two weeks for restoration, with up to four as the outer limit. It hopes to bring the site back in a reduced state sooner. Its status page is the place for official updates.
The takeawayIf you use AO3, change your password on any other site where you reused it, and rely only on the official status page for updates.