AO3 Outage Drags Into Weeks as Security Probe Keeps Fan Fiction Archive Dark

Archive of Our Own (AO3), the volunteer-run fan fiction repository that has become a cornerstone of online fandom, has been offline since October 29 after its operator detected what it calls a security incident. The Organization for Transformative Works (OTW), the nonprofit behind the site, now estimates that full restoration could take between two and four weeks — a timeline that has left millions of readers and writers without their primary creative outlet.

• Extended downtime: What began as routine overnight maintenance has stretched into a multi-week outage, with OTW warning of possible intermittent failures even after service resumes.
• Data uncertainty: The organization says it does not believe the user database was stolen but cannot rule it out; works, bookmarks, and kudos remain intact.
• Degraded return: AO3 may come back sooner in a limited or read-only state while volunteers complete their investigation.

How a Maintenance Window Became a Security Crisis

The trouble started on October 29, when AO3 went down for what was expected to be roughly 12 hours of maintenance. Later that day, the estimated downtime jumped to two to four weeks. On October 30, the site’s volunteer leadership confirmed it had detected evidence of a security incident and was still in the early stages of determining its scope.

“Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far.” — Organization for Transformative Works

Rebecca Tushnet, one of the OTW’s founders, told the New York Times that there had been “an intrusion” and that the team is working to identify the path the attacker used and ensure it has been removed. The organization has not publicly attributed the incident to any specific actor.

What Is Safe and What Remains in Doubt

The OTW has been careful to separate confirmed facts from open questions. No data has been deleted: published works, bookmarks, kudos, and other archive content are safe. Donor information is stored on a completely separate system and was not exposed.

The user database is a different matter. It may contain usernames, email addresses, IP addresses, and hashed passwords. OTW says it does not currently believe the database was stolen, but it cannot rule that out. Passwords are stored using an industry-standard hashing technique, which makes them harder to exploit even if obtained — but reused credentials remain a risk.

“While we currently don’t believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.” — Organization for Transformative Works

Users are being urged to change their AO3 password anywhere else it was reused, and to treat any email claiming to be from AO3 with suspicion until the site is fully restored.

Why Recovery Is Taking So Long

AO3 is run by volunteers and funded entirely by donations, a structure that can slow down incident response. The decision to keep the site offline while investigators work is also the cautious one: reopening a system whose compromise has not been fully mapped risks a second breach.

OTW hopes to bring AO3 back sooner in a degraded state — potentially read-only or with limited features — but warns that temporary additional shutdowns may be needed during recovery. As a precaution tied to what it described as a spam attack, the site has also temporarily disabled new account invitations; users who already hold an invitation can still redeem it.

Speculation about the cause has been widespread. Two critical PHP vulnerabilities circulated in the days before the outage, and OTW briefly closed its Fanlore wiki over the PHP flaw. However, AO3 is built on Ruby on Rails, making a direct connection unlikely, and the organization has not linked the incident to either vulnerability. A group calling itself Anonymous Sudan has claimed responsibility and reportedly issued a $30,000 Bitcoin ransom demand, but OTW has urged skepticism, noting that cybersecurity experts believe the group misrepresents its affiliation and motives.

The outage has also pushed readers toward archived copies of AO3 content, with the director of the Wayback Machine, Mark Graham, reporting a surge that is placing heavy load on the Internet Archive’s systems.

For a platform that won a Hugo Award for Best Related Work in 2019 and hosts roughly 18.8 million works, the episode underscores how much of fandom’s collective memory rests on a small volunteer-run nonprofit. The real test will come when OTW closes its investigation and states plainly whether an intruder accessed user data and what was taken. Until then, rotating reused passwords is the minimum sensible response — and a reminder that independent backups of creative work remain essential.