Archive of Our Own is still offline. More than three days after its operator warned that the user database might have been taken, no further public update has appeared. Anyone who reused their AO3 password should treat it as exposed, and employers should assume some of those passwords are also guarding work accounts.
What happened
Archive of Our Own (AO3) is the fan-fiction archive run by the US nonprofit Organization for Transformative Works (OTW). At 07:13 UTC on Thursday 29 October 2026 the OTW status page announced that the site was down for maintenance. The estimate grew to at least 12 hours that morning. By 17:41 UTC it had become roughly two weeks, possibly four.
The reason for the long outage came at 01:27 UTC on Friday 30 October. In a status update, and in a matching post on its own website, the OTW reported identifying “evidence of a security incident”. The investigation was at an early stage, it said, and the archive would remain dark until it finished.
According to the OTW, user content is intact: nothing users posted, bookmarked or gave kudos to has been lost. Its working view is that the account database was probably not taken, but it cannot exclude that. Those accounts hold a username, an email address, IP address records and a hashed password. AO3 does not ask for real names, and donor details live on an unconnected system the OTW says was not exposed.
As of Sunday 1 November the 30 October update was still the most recent one. The incident is listed as unresolved on the status page and nothing newer has appeared in the OTW news feed. The organisation has said it may not be able to answer individual queries and will post when it has more to say. Tech Times UK puts the archive at over 18.4 million works in more than 82,900 fandoms as of September 2026.
The technical picture
Very little technical detail has been released. The OTW has not named a cause, an entry point, a threat actor or a time window, and it has not said whether data left its environment. Tech Insider, citing TechCrunch, says the outage is unconnected to the PHP vulnerabilities that dominated October because AO3 is built on Ruby on Rails. The OTW itself has not said so.
The timeline still tells a defender something. The first notice called it maintenance. In under 11 hours the expected outage had gone from half a day to several weeks, and the security disclosure followed overnight. That pattern often suggests a team has found something serious enough to justify a rebuild rather than a patch. Recovering a production platform you no longer trust means rotating secrets, rebuilding hosts from known-good images, checking code and dependencies, and reviewing logs before anything goes back on the internet.
The data at risk matters more than the uncertainty. The OTW says it uses industry-standard password hashing, but it also says plainly that no hashing scheme fully protects a weak or reused password. If the database was copied, attackers will crack the easy hashes offline first. Usernames, email addresses and IP addresses are enough for convincing phishing, and in fandom communities a pseudonym can be personal information a user very much wants kept separate from their real identity.
Why it matters for UK organisations
AO3 is a hobby site, but its users are not separate from your workforce. Many of them are students, staff and contractors, and some will have used the same password on AO3 as on a work email, VPN or SaaS account. That is the real exposure for a UK organisation. A copied AO3 database that is cracked and loaded into credential-stuffing tools can quickly turn into login attempts against Microsoft 365, Google Workspace and remote access portals.
Schools, colleges and universities should pay particular attention because fan-fiction sites are popular with younger people. Expect phishing that exploits the outage: “your AO3 account has been restored”, “verify your password to recover your works” or fake donation appeals. These lures work because users are already waiting for news.
For data protection teams there is a governance point too. UK GDPR can reach organisations outside the UK that offer services to people here, and individuals can complain to the Information Commissioner.
Expert view
Credit where it is due: the OTW’s statement is clearer than many corporate disclosures. It lists exactly which fields could be exposed, says what is safe, admits what it does not know and gives one concrete action. In my experience, organisations that say “no evidence of data theft” and stop there leave users less safe than those that say “we cannot rule it out, so act as if it happened”. The OTW chose the second line, which is the right one.
What worries me is the silence since. Saying nothing while you investigate is understandable, especially for a volunteer-backed nonprofit with limited incident response resources. But silence leaves room for scammers, rumours and fake recovery messages. A short, regular holding statement, even one that only says “no change”, is a cheap defence against that.
When we test organisations, reused personal passwords remain one of the most reliable ways in. Breach corpora from consumer sites are routinely tested against corporate login portals, and the accounts that fall are the ones without phishing-resistant multi-factor authentication. Incidents like this are not exotic. They are how ordinary credential attacks get their fuel.
It is also worth separating what is known from what is not. We have seen no public claim of responsibility and no reports of AO3 data being offered for sale, and the OTW has not confirmed exfiltration. Defenders should not wait to find out.
What to do now
- If you use AO3, change any reused password now. Start with email, banking and work accounts, and turn on multi-factor authentication wherever it is offered. Use a password manager so every site gets a unique password.
- Enforce MFA on all internet-facing work logins. This is a core part of the Cyber Essentials user access control requirements. Prefer phishing-resistant methods for admin and remote access accounts.
- Turn on banned and breached password checks. Block known-compromised passwords at sign-in and password change, in line with NCSC password guidance and the Cyber Essentials password requirements.
- Watch for credential stuffing. Review sign-in logs over the coming weeks for spikes in failed logins, impossible travel and unfamiliar user agents, and make sure lockout or throttling is in place.
- Brief staff and students on AO3-themed phishing. Tell them updates will come only through the OTW’s official channels, and that no legitimate message will ask for their password.
- Keep personal and work identities apart. Discourage using work email addresses on personal hobby sites, which reduces both phishing exposure and the risk of linking pseudonyms to real identities.
Bottom line
AO3’s operator has been honest that its user database may have been taken, and it has said nothing since. Until the investigation reports, treat AO3 usernames, emails and reused passwords as exposed. For UK organisations the fix is unglamorous but effective: MFA everywhere, breached-password blocking and a quick warning to users about recovery scams.
Sources
- Organization for Transformative Works: Update on AO3 Downtime, October 30, 2026
- OTW Status: AO3 Down for Maintenance
- IBTimes UK: Fanfic Site AO3 Could Be Offline for up to 4 Weeks After ‘Evidence of a Security Incident’
- Tech Times UK: Archive of Our Own Warns User Data May Have Been Stolen as Site Faces 4-Week Shutdown
- Tech Insider: AO3 Offline 2-4 Weeks After Security Incident
