AO3 taken offline after a detected security incident
Original title: Archive of our own (AO3) hacked
Operators cannot rule out theft of usernames, emails, IP addresses and hashed passwords, and expect two to four weeks offline.
Archive of Our Own said it detected a security incident and will keep the site down while investigating. No works, bookmarks or kudos were deleted, and AO3 does not collect real names. Donor data sits in a separate system and was not exposed. The team does not currently believe the user database was stolen but cannot rule it out, and it expects restoration in about two weeks, possibly up to four, with a possible degraded or read-only return sooner.
Unconfirmed: AO3 says it does not believe the user database was stolen but cannot rule that out.
- Account data may include username, email, IP address and a hashed password.
- Users should change any password reused from AO3 on other sites.
- Restoration is estimated at two weeks and could take four.
- A degraded or read-only return may still require later shutdowns.
- The incident was identified on October 29, 2026, with an update on October 30.
Impact: Possible exposure of usernames, emails, IPs and hashed passwords
| Product | Affected |
|---|---|
| AO3 | — |
- 1.Change passwords on other sites that reuse the AO3 password.
- Products
- AO3
- Victims
- Archive of Our Own
From the original article
2 min read at otwstatus.orgUpdate - Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far.
By idlewords · otwstatus.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.