Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

AO3 stays offline after security incident; recovery may take weeks

2 sources · 3 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Archive of Our Own remains down after a confirmed security incident, with restoration estimated at about two weeks and possibly a month.

The Organization for Transformative Works took Archive of Our Own offline on October 29, first calling it maintenance and confirming a security incident the next day. 404 Media says restoration may take about two weeks and up to a month; Hacker News reports the operators’ estimate as about two weeks and possibly four, with a degraded or read-only return possible sooner and further shutdowns still likely. OTW told CNET the site uses Ruby on Rails and that the outage is unrelated to this week’s PHP issue, and it does not expect data loss. No works, bookmarks or kudos were deleted, and donor data in a separate system was not exposed. The team does not currently believe the user database was stolen but cannot rule out theft of usernames, emails, IP addresses and hashed passwords.

Key facts
  • Incident identified October 29; a security incident was confirmed October 30.
  • As of September, AO3 hosted over 18.4 million works across over 82,900 fandoms.
  • OTW told CNET the archive uses Ruby on Rails, not PHP.
  • Possible exposed account data: username, email, IP address and hashed password.
  • AO3 does not collect real names; users should change reused passwords.
  • Some authors are posting drafts on other sites during the outage.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026AO3 went down; the security incident was identified. · Hacker News
  2. Oct 30, 2026Updated status report confirmed a security incident. · 404 Media

What each outlet adds

beyond the shared facts
  • 404 MediaMaintenance framing changed to a security incident; Rails, not PHP.
  • Hacker NewsAccount fields possibly exposed; donor data and works not affected.
Products
AO3Archive of Our Own
Victims
Archive of Our Own
Organizations
Organization for Transformative Works

Coverage

oldest first · one row per article · UTC
  1. · 1d ago 404 MediaFirst report

    Archive of Our Own says outage may last up to four weeks

    OTW moved its estimate from 12 hours to about two weeks, and possibly a month.

  2. · 8h ago 404 Media

    AO3 outage tied to a security incident may last up to a month

    OTW says restoration may take about two weeks and up to a month, and it does not expect data loss.

  3. · 5h ago Hacker News · security

    AO3 taken offline after a detected security incident

    Operators cannot rule out theft of usernames, emails, IP addresses and hashed passwords, and expect two to four weeks offline.