AO3 Says Security Incident Could Keep Fan-Fiction Site Offline for Four Weeks

AO3 says it detected a security incident but has not disclosed whether it was a breach, denial-of-service attack or another type of intrusion. [1]

The site expects to remain offline for at least two weeks and possibly four, with a degraded or read-only version possible sooner. [1]

Users should change passwords reused elsewhere; the organization says it has not confirmed access to the user database and that donor information is stored separately. [1]

Archive of Our Own could remain offline until late November after the Organization for Transformative Works detected evidence of a security incident, the nonprofit said in an October 30 update. AO3 was initially taken down for what was described as maintenance on October 29. [1]

The organization has not identified the attack type or said whether law enforcement is involved. It said no works, bookmarks or kudos have been deleted, but it cannot rule out theft of the user database, which may contain usernames, email addresses, IP addresses and hashed passwords. [1]

OTW recommends changing passwords on other websites where users reused their AO3 password. It said AO3 does not collect real names and that donor information is kept in a separate system that is not linked to AO3. [1]

The site may return in a degraded state, including with some features unavailable or in read-only mode, but OTW warned that it could be taken offline again during recovery. [1]