AO3 stays down after security incident; data theft not ruled out
Original title: Update on AO3 Downtime, October 30, 2026 | Organization for Transformative Works
Works were not deleted; the outage may last two to four weeks, and reused passwords should be changed elsewhere.
The Organization for Transformative Works said it detected a security incident on AO3 and is keeping the site offline while it investigates scope. No works, bookmarks or kudos were deleted. Staff do not currently believe the user database was stolen but cannot rule it out; stored data can include username, email, IP address and a hashed password. Donor records sit in a separate system and were not exposed. AO3 is expected to stay down at least two weeks and possibly four, with a possible degraded or read-only return.
Unconfirmed: Whether the user database was stolen is unconfirmed; the organization says it cannot rule theft out.
- AO3 does not collect real names, so none could be exposed.
- Passwords are stored scrambled, but weak or reused ones can still be cracked.
- A degraded return could later be taken offline again during recovery.
- Staff said they may not answer individual user inquiries.
Impact: Possible exposure of usernames, emails, IPs and password hashes
| Product | Affected |
|---|---|
| Organization for Transformative Works AO3 | — |
- 1.Change the AO3 password on any other site where the same password was reused.
- Products
- AO3
- Victims
- AO3
- Organizations
- Organization for Transformative Works
From the original article
1 min read at transformativeworks.orgThe Archive of our Own aka AO3, a huge, non-profit, volunteer-run fanfic archive with over 11 million registered users, discovered a security incident yesterday and took the site down. They expect the site to be down at least two weeks. Comments
By transformativeworks.org via horrorcheck · transformativeworks.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.