AO3 Still Down After Cyberattack: What to Do Now

Archive of Our Own, the fan fiction site most people just call AO3, has been offline since October 29, and it isn't coming back this week. The group that runs it says a security incident is behind the outage. If you have an account, a couple of quick steps now will save you trouble later.

Update (Nov 11): AO3 is still offline, and the status update I quoted below is still the latest one: restoration is going well and the original two-to-four-week estimate holds. Counted from 30 October, that window opens this Friday, 13 November. Expect the site to be slow when it does return, because a lot of people will hit it at once.

What happened

AO3 went down for what looked like routine maintenance on October 29. The next day, the Organization for Transformative Works (OTW), the non-profit behind the site, said in an update on October 30 that it had found evidence of a security incident and would keep AO3 offline while it investigated.

The OTW says no works, bookmarks or kudos have been deleted. It also says it doesn't believe the user database was stolen, but it can't rule that out yet. That database holds usernames, email addresses, IP addresses and hashed passwords.

On November 6, the AO3 status page posted its first fresh update in a week, quoted in full by Bleeding Cool. The team says restoration is going well, its original estimate of two to four weeks still stands, and it's working to make sure drafts aren't deleted. Kudos and subscription emails that landed in inboxes that day were queued before the outage and are genuine. AFP reports OTW co-founder Rebecca Tushnet saying there is no data loss and the site should be back within a month.

Why it matters

This isn't a small site. AFP puts AO3 at more than 11 million registered users and nearly 18 million stored works. A database that size, with email addresses and password hashes in it, is a real target even if nothing has leaked so far. Hashed passwords aren't stored in plain text, but weak ones can still be cracked if a copy gets out.

The outage has also turned into an opening for scammers. Sites are posting what look like scraped copies of AO3 stories, and fake offers of "private access" are going around.

My take: what AO3 users should do now

You can't log in to AO3 right now, so you can't change your password there. What you can do is cut off the damage if the worst turns out to be true.

1. Change any reused password. If your AO3 password is the same as your email, social or shopping login, change those other accounts today. This is exactly what the OTW recommends. A password manager makes it painless.
2. Turn on two-step login for your email. Your email is the key to every other reset, so protect it first.
3. Ignore anything offering access. The OTW says there are no mirrors of AO3, no official app, and no public tester sign-ups. Anyone offering a way in, or asking for money to "bring AO3 back", is running a scam. Real donations only go through otw.org/donate.
4. Don't hand over details to get a stolen fic taken down. If you find your work on a copy site, don't send that site your login or personal info. Report it through the host or a proper DMCA route instead.
5. Be careful with zip files and shared drives. Reading fics on other archives or on social media is far safer than downloading bundles from strangers.

My own read on timing: two to four weeks from October 30 lands somewhere between about November 13 and November 27. When AO3 does return, I'd change the password there too, even if the OTW confirms nothing was taken. It costs a minute.

We've seen this pattern before. When Capcom ID had its breach, the advice came down to the same thing: reused passwords are what turn one leak into many. If that's you, AO3's downtime is a good nudge to fix it everywhere, not just for one site.

If the breach has you worried about your own PC, my step-by-step malware check is a good place to start. And if you talk fics in Discord servers, see how to keep your Discord messages out of Google search.