Fan Fiction Site AO3 Could Stay Offline for Weeks After Security Incident
Archive of Our Own detected a breach during routine maintenance on Oct. 29; the nonprofit says restoration could take two to four weeks and can't yet rule out user data theft.
Archive of Our Own — the sprawling fan fiction platform that hosts millions of stories and commands one of the internet's most devoted communities — went dark on October 29, 2026, after what was meant to be routine overnight maintenance. It may not come back fully for a month.
The Organization for Transformative Works (OTW), the nonprofit that runs AO3, confirmed it had detected a security incident and said the site would remain down while its volunteer team investigates. The estimated timeline for full restoration is two to four weeks, though OTW said it hopes to bring up a degraded, possibly read-only version sooner — with the caveat that temporary additional takedowns may be needed during the recovery process.
Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far.— Organization for Transformative Works
The most pressing question for AO3's users is whether their personal data was taken. OTW has offered a carefully hedged answer: the user database — which may contain usernames, email addresses, IP addresses, and hashed passwords — has not been confirmed stolen, but cannot be ruled out either. Donor information, held in a separate system, was not exposed. No works, bookmarks, or kudos have been deleted.
While we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.— Organization for Transformative Works
AO3 stores passwords using an industry-standard hashing technique, which makes them significantly harder to exploit even if obtained. Still, OTW is recommending that users change their passwords on any other site where they may have reused the same credentials — standard advice after any potential breach.
The scale of the community's reaction underscored how central AO3 has become to fan culture: within two hours of the outage announcement, posts on the site's status page had drawn millions of views and waves of panicked commentary across social media, according to TechCrunch.
A group calling itself Anonymous Sudan has claimed responsibility and, according to the Verge as cited by icucycle.com, initially said the attack was meant to last up to 24 hours before issuing a $30,000 Bitcoin ransom demand and threatening a prolonged shutdown if it went unpaid. OTW has urged users to treat those claims with skepticism, noting on Twitter that cybersecurity experts believe the group is lying about its affiliation and reasons for attacking websites. Because OTW is funded entirely by user donations and run by volunteers, meeting a ransom of that size would in any case be extremely difficult.
[C]ybersecurity experts believe the group claiming responsibility is lying about their affiliation and reasons for attacking websites. View the group's statements with skepticism.— Archive of Our Own / OTW, via Twitter
As a precautionary measure tied to what OTW described as a spam attack, the site has also temporarily disabled new account invitations. Users who already received an invitation can still redeem it, but anyone in the queue will not receive one until the feature is restored, the organization announced.
Some observers wondered whether the outage was connected to last week's 'PHP Armageddon' — the discovery of two critical flaws in PHP, the programming language underpinning roughly 70 percent of the web, found by tools from OpenAI and Google Wiz. TechCrunch reported that AO3 is built on Ruby on Rails, a different framework, making a connection to that vulnerability unlikely.
The situation remains fluid. OTW has said its volunteers are prioritizing a thorough investigation over speed — a choice that reflects both the seriousness of what was found and the limits of a nonprofit that depends on community goodwill to exist.
Why it matters — Millions of fan fiction readers and writers face weeks without access to one of the web's largest creative archives, and cannot yet know whether their personal account data was stolen.
⚠ Not yet confirmed
- Anonymous Sudan is responsible for the attack and issued a $30,000 Bitcoin ransom demand threatening weeks of downtime.
- The attack initially targeted AO3 for up to 24 hours before the ransom demand extended the threat.
- two references to 'according to the New York Times'
- specific date 'As of November 1'
- Full restoration is estimated at two to four weeks; a read-only version may come back sooner.
- Donor information was stored separately and was not exposed.
Reported by sfcrowsnest.info, techcrunch.com, nytimes.com, icucycle.com
