AO3 offline for weeks after security incident

Archive of Our Own (AO3), the world’s largest fan fiction library, has been offline since Oct. 29 and could stay down for as long as four weeks after its operator confirmed a security incident, according to the organization and multiple news reports.

The Organization for Transformative Works (OTW), the non-profit that runs the site, first described the outage as maintenance. It said the next day that it had detected evidence of a security incident and was in the early stages of investigating how far it reached. As of Nov. 2, the site remained offline with no confirmed return date.

The OTW has estimated the site will be down for a minimum of two weeks and possibly as long as four weeks, Gizmodo reported. Dexerto and other outlets reported the same window. The site could return in a limited state, such as read-only, and could go down again during recovery, the organization warned.

The incident has been widely described as a hack. The New York Times reported on Oct. 30 that the site had been hacked and its 18 million stories knocked offline. The OTW’s own wording is narrower. It has referred to a security incident and has not publicly detailed how the site was breached.

The organization said it does not currently believe its user database was stolen, but it cannot yet confirm whether the database was accessed. Information that could be exposed includes usernames, email addresses, IP addresses and hashed passwords. Users have been advised to change their passwords on any other site where they reused their AO3 password.

The OTW said no AO3 content has been deleted. Stories, bookmarks and other user content remain intact, it said. AO3 has about 11 million registered users and hosts more than 18 million fan works, according to reporting on the outage and the site’s public listing.

The outage has sent readers and writers searching for the site and for alternatives. “AO3 fanfiction” was among the trending searches in Canada on Google on Nov. 2. Wired reported that fans have been sharing “survival guides” for the outage, including ways to keep track of unfinished stories while the site is down.

AO3 is run by volunteers and funded by donations. It hosts fan-written stories based on books, films, television series, video games and real-world celebrities. Its scale has made it a central archive for fan communities worldwide, including many in Canada.

The OTW has not said who was responsible for the incident or whether any data was taken. It said it will post updates as its investigation continues. Canada News Media will update this story if the organization confirms a return date or the scope of any data exposure.

Canada News Media has also reported on cyber attacks on supermarkets in seven European countries and on a federal privacy investigation into a Crime Stoppers data breach.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.