AO3 Security Incident: What the Weeks-Long Outage Means

By Jaspal Singh October 31, 2026 Updated: October 31, 2026

Archive of Our Own (AO3) went offline on October 29, 2026, and its operator now says a security incident will keep it down for two to four weeks. No stories, bookmarks or kudos were deleted, but the nonprofit cannot rule out theft of the user database, so anyone who reused their AO3 password elsewhere should change it now.

What Happened

The first sign of trouble was mundane. At 07:13 UTC on October 29, the Organization for Transformative Works status page said AO3 was "down for maintenance." Two hours later it added that the work would take at least 12 hours. By 17:41 UTC the estimate had grown to around two weeks, possibly four, with a hope of bringing the site back sooner in a reduced form.

The reason arrived in the early hours of October 30. In an official update titled "Update on AO3 Downtime, October 30, 2026," posted on the OTW news site at transformativeworks.org and mirrored on its status page, the organization said it had "detected evidence of a security incident on AO3" and was still in the early stages of working out its scope. The site, it said, would stay down while volunteers investigate and fix what they have found so far.

The same post made four concrete statements. No AO3 data has been deleted, so works, bookmarks and kudos are safe. The OTW does not currently believe the user database was stolen, but it cannot rule that out. AO3 never collected real names, so none could leak. Donor records live in a separate system that is never linked to AO3 and were not exposed.

Engadget reported that the OTW had already logged problems with email notifications, search, reading history and listings on October 23 and 24. Nobody has said whether those glitches were connected to the incident. According to 404 Media, which cited a statement the OTW gave CNET, the organization says the outage is unrelated to the PHP vulnerabilities that hit many sites this month, because the Archive runs on Ruby on Rails rather than PHP.

The scale is large. Gizmodo, citing OTW figures, put AO3 at more than 18 million fanworks and over 11 million registered users as of this summer. The site was founded in 2008 and is run by the OTW, a US 501(c)(3) nonprofit whose engineers are largely volunteers.

Why It Matters

For readers and writers, the immediate cost is access. AO3 is where a huge share of English-language fan fiction lives, and the outage landed at the end of October, when many writers were mid-way through themed writing challenges. 404 Media found authors moving chapters to Space Battles, Tumblr and shared Google Docs, and the forum Sufficient Velocity put up a banner welcoming displaced AO3 users. None of those replace AO3's tagging and search, which is what makes a long, multi-chapter work discoverable.

The security side matters more for the long term. The OTW lists what the user database may contain: username, email address, IP address and a hashed password. Each of those carries a different risk. Email addresses invite phishing. IP addresses can hint at a rough location and can tie a pseudonymous fan account to other activity. For a community where many people write under pseudonyms by choice, that is not a small thing, even if the OTW's current belief is that nothing left its servers.

The incident also fits a wider pattern. October 2026 has brought a run of serious breaches and emergency patches, including the PHP flaws we covered in our explainer on PHP2Shell's third vulnerability. Small nonprofits with volunteer staff face the same attackers as large companies, with far fewer people to respond.

How It Works

The most useful thing to understand is why the OTW is asking you to change passwords on other sites rather than on AO3 itself, which is offline anyway.

AO3 does not store passwords. It stores a hash: the output of a one-way function that turns your password into a fixed-length string. When you log in, the site hashes what you typed and compares the two results. If an attacker steals a database of hashes, they cannot simply read the passwords. They have to guess, hash each guess, and look for a match.

AO3's software is open source, so its approach is public. The otwarchive repository on GitHub shows the site uses Devise, a common Rails sign-in library, with the bcrypt hashing algorithm and a cost setting of 14 outside test environments. bcrypt is deliberately slow, and each step of the cost setting doubles the work for every guess. A cost of 14 is four times the work of Devise's default of 12. That slowness is barely noticeable when one person logs in, but it becomes a serious obstacle when an attacker wants to try billions of guesses.

Slow is not the same as impossible. bcrypt also salts each password, mixing in a random value so that two users with the same password get different hashes. That stops an attacker from cracking everyone at once with a precomputed table. It does nothing for a password that is short, common or already circulating in older breach lists. Attackers start with exactly those lists, so sunshine2015 falls in seconds no matter how good the hashing is. The OTW's own wording is blunt: no hashing method can fully protect a weak or reused password.

That is the chain of risk. If the database was taken, and if your AO3 password was weak or reused, an attacker could recover it and try the same email and password on your email account, social media or shopping sites. Changing the password everywhere you reused it breaks that chain, whatever the investigation finds.

A few practical steps follow from that:

Change reused passwords first, starting with your email account, because email controls password resets everywhere else. A password manager makes unique passwords painless.
Check whether your browser has flagged the password. Chrome and other browsers compare saved logins with known breach lists, as we explained in our piece on how Chrome warns you about breached passwords.
Treat AO3 emails with suspicion for a while. A message claiming to be from AO3 that asks you to "verify" your account through a link is the obvious phishing play. Go to the OTW's official status page instead of clicking.
Keep your own copies of works you love. AO3 lets readers download works as EPUB, PDF and other formats. Once the site returns, saving favourites locally is a cheap insurance policy, in line with the habits in our data backup and recovery guide.

Until then, archived copies of some public works may exist in services like the Internet Archive's Wayback Machine. Our older guide to viewing sites that won't load covers how cached copies work, though coverage of any given story is hit and miss.

What's Still Unknown

Almost everything about the attack itself. The OTW has not said how the attacker got in, which systems were reached, when the intrusion began, or whether it is connected to the feature problems logged on October 23 and 24. It has not said who might be responsible.

The key question, whether the user database was copied, is still open. The OTW's current belief is that it was not, but forensic work on a compromised server often changes early conclusions in either direction. If the answer changes, users should expect a further notice.

The return is also uncertain. The OTW expects a minimum of two weeks and up to four. It may bring AO3 back earlier in a degraded state, possibly read-only or with some features missing, and it has warned that the site could go down again without notice during recovery. Whether all accounts will be forced to reset passwords on return has not been announced.

Frequently Asked Questions

Why is AO3 down right now?

The Organization for Transformative Works took AO3 offline on October 29, 2026, first describing it as maintenance. On October 30 it said it had detected evidence of a security incident and would keep the site down while it investigates and fixes what it has found. It has not described how the attack happened or which systems were affected, and further updates are posted on its status page.

When will AO3 come back online?

The OTW's current estimate is a minimum of two weeks from October 30 and possibly up to four weeks. It hopes to restore a degraded version sooner, which might be read-only or missing some features. It has warned that a restored site could be taken down again unexpectedly during recovery, so an early return may not be a stable one.

Were my fan fiction works or bookmarks deleted?

No. The OTW states plainly that no AO3 data has been deleted and that works, bookmarks, kudos and similar content are safe. The outage blocks access to that content; it has not erased it. Writers who planned to post during the downtime can keep drafting offline or share chapters elsewhere and upload them to AO3 once the site returns.

Was my AO3 password stolen?

Not known. The OTW says it does not currently believe the user database was stolen but cannot rule it out. If it was, attackers would hold a bcrypt hash of your password, not the password itself. Strong, unique passwords are very hard to recover from such hashes, while weak or reused ones can be cracked, which is why the OTW recommends changing reused passwords.

What personal information does AO3 hold about me?

According to the OTW, the AO3 account database may include your username, email address, IP address and a hashed version of your password. AO3 does not collect real names, so those could not be exposed. Donor information is kept in a separate system that is never linked to AO3, and the OTW says that system was not exposed in this incident.

Do I need to change my AO3 password?

You cannot change it while the site is offline, and the OTW has not yet said whether it will require resets. The more urgent step is changing the same password on any other site where you used it, especially your email account. When AO3 returns, setting a new, unique password there is a sensible extra precaution.

Is the AO3 outage linked to the PHP security flaws?

The OTW says no. According to 404 Media, citing a statement to CNET, the organization said the outage is unrelated to the PHP vulnerabilities disclosed this month because AO3 runs on Ruby on Rails. Fanlore, another OTW project, was briefly shut down over the PHP issue, but that was a separate site and a separate decision.

Where can I read or post fan fiction while AO3 is down?

Writers have been moving chapters to forums such as Space Battles and Sufficient Velocity, to Tumblr and to shared Google Docs, and some readers are returning to FanFiction.net. Previously downloaded EPUB or PDF copies still work offline, and some public works may survive in web archives. None of these match AO3's tagging and search, so many writers plan to repost once it returns.