The Organization for Transformative Works says it detected evidence of a security incident at Archive of Our Own, its fanfiction archive. Its October 30 notice says AO3 will remain offline during investigation and recovery. It recommends changing passwords on other sites wherever they match an AO3 password.

Evidence status: an incident reported by the site’s operator. Database theft remains unconfirmed. OTW says it currently does not believe the user database was stolen, but cannot rule that out. Emily Maskell’s October 30 PinkNews report quotes the disclosure; it supplies no independent forensic confirmation of theft.

Preserved works and private account data are different questions

OTW says no AO3 data has been deleted, including works, bookmarks and kudos. That is reassurance about preservation. It leaves the separate question of unauthorized copying unresolved.

The account database may contain:

  • Usernames and email addresses, which can connect an account to a contact address.
  • IP addresses, meaning network addresses associated with users.
  • Hashed passwords, stored as scrambled representations rather than the original password text.

OTW says it uses industry-standard password storage. Its warning is still practical: weak or reused passwords can be cracked despite hashing. The notice does not name the algorithm, establish that anyone obtained hashes, or report successful account takeovers.

OTW also says AO3 does not collect real names and that donor information lives in a separate system, unlinked to AO3. It says donor data has not been exposed. Those statements describe the operator’s assessment, not an independently audited account of the incident.

Change reused passwords without waiting for AO3 to return

The operator’s immediate recommendation concerns other sites where the same password is used. Those accounts can be secured while AO3 is unavailable.

  1. Replace reused passwords on those services with unique ones. Use each service’s own site or app, reached directly, rather than an unsolicited recovery link.
  2. Secure the email account used for AO3 if it shares that password. Access to email can enable password resets elsewhere. Enable multifactor authentication where available as an additional precaution.
  3. Treat unexpected incident messages cautiously. A username or email address would help a sender impersonate a legitimate notice. This is a precaution, not a report that OTW has observed a phishing campaign.
  4. Follow OTW’s official updates for AO3-specific recovery instructions. Its directory of official outlets identifies the status page and project accounts.

The first step is OTW’s explicit advice; the others are practical account-protection measures. The notice announces no blanket session reset or completed password-reset process for AO3 itself.

Recovery may take weeks

OTW’s current estimate is a minimum of two weeks, possibly up to four weeks of downtime. It may restore a limited or read-only service earlier, with further interruptions during recovery. This is an estimate, not a promised restoration date.

The notice publishes no entry point, affected software version, attacker attribution or verified account-exposure count. It supplies no vulnerability identifier or fixed-version guidance. The outage alone cannot establish ransomware, database theft or destruction of the archive.

Caveat: the investigation is at an early stage. OTW’s preservation assurance and its uncertainty about account-data theft must be kept separate as the facts develop.