AO3 Security Incident: Archive of Our Own Offline Since October 29, What Is Confirmed and What Website Owners Should Check

Archive of Our Own, the huge fan fiction library known as AO3, has been offline since October 29, 2026, and the nonprofit that runs it says it found evidence of a security incident. If your business runs a website with customer logins, this is worth your time: it shows how long a site can stay dark after an incident, and what people will want to know while it does.

AO3 is run by the Organization for Transformative Works (OTW). Gizmodo reported that the archive hosts more than 18 million fanworks and had "over 11 million registered users as of this summer."

Why is AO3 down? The timeline

These entries come from OTW's own status page. Times are UTC.

As of November 8, the November 6 post was the latest update we could find, and it did not say the site was back.

What is confirmed about the AO3 security incident

OTW's status updates state the following:

• OTW "detected evidence of a security incident on AO3."
• "No AO3 data has been deleted," and OTW says works, bookmarks and kudos are safe.
• The user database holds account information that may include a username, email address, IP address and a hashed version of the password.
• On theft of that database, OTW wrote: "we currently don't believe that the user database was stolen, we are also unable to rule it out."
• AO3 does not collect real names.
• Donor information "is held in an entirely separate system and is never linked to AO3." That is OTW's description of how the data is stored. The investigation is still open, so watch for its final findings.

What is claimed, and what is not known

Some headlines call this a cyberattack or a hack. OTW's updates use the phrase "security incident" and do not name a type of attack, an attacker, a ransom demand or a cause.

As of November 8, these points are not publicly known:

• Whether the user database was copied.
• How the incident started.
• Which hashing method protects AO3 passwords. The updates do not say, and it matters because weaker methods are faster to crack.
• The exact return date.

AO3 password advice: what to do this week

Why a website outage like this matters for a business

Nothing published so far says OTW did anything wrong, and we do not know what happened inside its systems. The useful part is the set of questions this raises for anyone running a site with accounts.

Check these against your own website or customer portal:

• Test a full restore. Time how long it takes to rebuild your site from backup onto clean servers. If nobody knows the answer, that is your first job. If you run your own servers, our self-hosting and infrastructure page covers what that setup involves.
• Decide on read-only mode now. OTW says it may return in a degraded state, possibly read-only, and might have to take the site down again. Choose in advance which features you could switch off.
• Keep your status page separate. OTW's status page sits on its own domain and stayed reachable while AO3 was down. A status page on your main site disappears with it.
• Know what your user database holds. OTW could say right away that real names were not collected. Data you never gathered cannot leak.
• Hash passwords properly. Use a modern method such as Argon2 or bcrypt, so a stolen database is much harder to turn into working passwords.
• Send logs somewhere else. "Was the database copied?" is the question every customer will ask. We do not know why OTW cannot rule it out yet, but logs kept only on an affected server may not be trustworthy.
• Write the customer notice in advance. OTW's update said what the database may hold, what was safe and what users should do. Keep a template that covers those three things.
• Watch for copycats. 404 Media reported that a site called ao3.life appeared after the outage, reposted scraped AO3 works and sold AI-generated audiobooks, then went down after more than 2,000 takedown requests. The report does not connect it to the security incident, but it shows how quickly others can move into the gap when a site goes dark.

AO3 security incident questions people are asking

Why is AO3 down?

OTW first described the outage as maintenance, then said it had detected evidence of a security incident. It has not published a cause.

When will AO3 be back up?

OTW has given no date. Its estimate is at least two weeks and possibly four. Counting from October 29, which is our own arithmetic, that means roughly November 12 to November 26. OTW has warned the site may return in a limited form and could go down again.

Was AO3 hacked?

OTW confirms a security incident but has not said what kind. It has not used the word hacked in the status updates we read.

Was my AO3 data stolen?

That is not known. OTW says it does not currently believe the user database was stolen, but it cannot rule that out.

Were AO3 fics deleted?

OTW says no AO3 data has been deleted and that works, bookmarks and kudos are safe. On drafts, it says it is working to make sure they are not deleted during this period.

Should I change my AO3 password?

Change it now on any other site where you used the same password, as OTW recommends. AO3 itself is offline, so change that one when the site returns.

Are the emails from AO3 real?

OTW says some subscription and kudos notifications held in a queue from before the outage were sent and are genuine. Treat any message asking you to log in with suspicion.

Is ao3.life the real AO3?

No. 404 Media described it as a clone that scraped AO3 works, and the site has gone down.

The bigger lesson

Most businesses plan for keeping attackers out and spend far less time planning for the weeks after something gets through. Knowing what data you hold, having a restore you have actually tested and being able to tell customers the truth quickly are all things you can settle before anything goes wrong.

Want your backups tested and your site locked down? See our security hardening services or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: OTW Status: AO3 incident report; OTW Status; Gizmodo; 404 Media.