The AO3 security incident has taken Archive of Our Own offline, and the site’s volunteers say it could stay down for two to four weeks. They can’t rule out that some user data was accessed, so the one thing worth doing today is changing any password you reused from AO3.
Here’s the short version of what’s confirmed, what isn’t, and what to do while you wait.
Quick facts
- The outage began Thursday, Oct. 29, 2026, first described as maintenance.
- On Oct. 30 the site’s operators disclosed evidence of a security incident.
- Estimated recovery: two to four weeks, possibly with a degraded or read-only return first.
- Possibly exposed: usernames, email addresses, IP addresses and hashed passwords.
- No stories, bookmarks or other content have been deleted, according to the site.
What AO3 has said so far
The Organization for Transformative Works (OTW), the nonprofit behind AO3, first posted that the site was down for maintenance. Later updates changed that to a security incident, with the repair estimate stretching from hours to weeks.
According to Gizmodo, the OTW said it is still early in working out the scope. It also said it may bring the site back “in a degraded state,” which could mean missing features or read-only access. IBTimes reported the same two-to-four-week window.
There’s a lot nobody has said yet: how the intruder got in, who they are, and how many accounts were touched. Treat any claim about those details as unconfirmed until the OTW publishes them.
What data could be exposed on Archive of Our Own
The OTW says the user database may hold four kinds of information. Here’s what each one means for you in practice.
| Data | Why it matters | What you can do |
|---|---|---|
| Username | Links your AO3 identity to your fandom activity. | Nothing urgent. Be wary of messages that mention it. |
| Email address | Makes you a target for phishing that looks like AO3 mail. | Don’t click “reset your password” links you didn’t request. |
| IP address | Gives a rough location, not a street address. | Low risk for most people. A VPN helps going forward. |
| Hashed password | Hashing scrambles it, but weak ones can still be cracked. | Change it anywhere you reused it. |
Reports also say AO3 doesn’t collect real names and keeps donor details in a separate system. That’s good news, but it comes from secondary coverage, so check the OTW’s own updates for the final word.
What to do now after the AO3 security incident
You can’t log in to AO3 right now, so the useful steps all happen elsewhere. Start with the first one.
- Change the password on any other account that used your AO3 password, email first.
- Turn on two-factor authentication for your email account.
- Use a unique password for every site. A password manager makes that realistic, and our look at 1Password’s AI login feature shows how they’re evolving.
- Ignore unexpected emails about AO3 accounts, breaches or “verify now” links.
Why this order? A stolen hashed password is only dangerous if the same password opens something else. Fixing reuse removes most of the real risk.
If you use fan sites, you may also care who can copy your writing. Our guide to the AI training opt-out and robots.txt covers what site owners can and can’t block.
How to spot a fake AO3 email
Breaches like this are a gift to scammers, because they know people are anxious and looking for news. Expect messages that claim to come from AO3 or the OTW.
A real notice will not ask for your password, and it won’t push you to log in through a link in the email. If a message says your account is locked or needs “verification,” go to the official site by typing the address yourself.
Check the sender’s domain carefully, since look-alike addresses often swap a single letter. When in doubt, delete it. The OTW’s real updates will be posted on its own channels.
How long will AO3 stay down?
The official estimate is two to four weeks from the end of October. That points to a return somewhere between mid-November and late November, though that’s our reading of the estimate, not a promise from the OTW.
Expect bumps. The OTW has warned it may need to pull the site down again without notice during recovery. A read-only reopening would let you reach your bookmarks and reading history before full features come back.
If you write on AO3, keep local copies of your drafts from now on. Nothing is reported deleted, but a site rebuild is a good reminder that one copy is never enough.
Frequently Asked Questions
Is AO3 down for everyone?
Yes. The site was taken offline on purpose while the OTW investigates, so refreshing or switching networks won’t help.
Was my AO3 password stolen?
The OTW says it doesn’t currently believe the user database was stolen, but it can’t rule out access. Assume it might have been and change reused passwords.
Are my stories and bookmarks gone?
No. The site says no content, including stories and bookmarks, has been deleted.
When will Archive of Our Own be back?
The OTW estimates two to four weeks, and a partial or read-only return could come first. Follow its official channels for updates.
The bottom line for AO3 users
Don’t panic, but don’t wait either. Spend ten minutes today fixing reused passwords and locking down your email, then ignore the noise until the OTW publishes a full account. A volunteer-run site disclosing this early and plainly deserves some patience, and your own cleanup is the only part you control.
Leave a Reply