Archive of Our Own says it detected evidence of a security incident and cannot rule out theft of its user database. The fanfiction site expects to remain offline for at least two weeks, possibly four.
In an update posted October 29 at 6:27 p.m. Pacific, the Organization for Transformative Works said works, bookmarks and kudos have not been deleted. It currently does not believe the user database was stolen, but its investigation is still at an early stage.
Account information may include usernames, email addresses, IP addresses and hashed passwords. OTW cautions that weak or reused passwords can still be cracked despite hashing. It recommends changing passwords on other sites where the same password was used for AO3. It says donor information is held separately and has not been exposed.
A limited return could provide read-only access or leave some features unavailable. OTW warned that the site could go offline again during recovery.
For readers who already saved stories, AO3's download feature provides a separate way to keep reading. The archive's April feature overview identifies AZW3, EPUB, MOBI, PDF and HTML downloads as formats for offline access. A file already saved on a device can be opened in a compatible reader without loading its AO3 page. A browser bookmark alone is a link to that page, not a downloaded story.
AO3 is a fan-run, donor-supported archive of fanworks, including stories based on existing books, movies and television. In its April announcement, it celebrated reaching 10 million registered users and 17 million fanworks.
Follow the official status page for restoration updates.
