Why is Archive of Our Own down? AO3 warns of security incident and possible data breach

Archive of Our Own (AO3) has been taken offline following a security incident, with the fanfiction platform warning users that its outage could last between two and four weeks as investigations and recovery efforts continue.

The platform’s team confirmed the incident on October 30, 2026, saying it had detected evidence of a security breach earlier in the day. AO3 remains unavailable while its team investigates the incident and works to address the issues identified so far.

In a statement, the platform said it was still in the early stages of responding to the incident and determining its scope. Although the team has not confirmed whether user data was stolen, it said the possibility could not be ruled out.

The AO3 database contains account information that may include usernames, email addresses, IP addresses and hashed passwords. The platform said it currently does not believe its user database was stolen, but warned that it cannot yet confirm whether it was accessed.

AO3 uses industry-standard methods to store passwords in a scrambled form that is not easily reversed. However, the team cautioned that weak or reused passwords could still be vulnerable to cracking.

As a precaution, users have been advised to change passwords on other websites if they have reused the same password they use for AO3.

The platform also clarified that no data has been deleted as a result of the incident. Users’ works, bookmarks, kudos and other content remain safe.

AO3 does not collect users’ real names, meaning that information cannot have been exposed through its database. The team also confirmed that donor information is held in a separate system and is not linked to AO3, so it has not been affected by the incident.

The platform’s team said it would continue to share updates through its official channels as the investigation progresses, although it may not be able to respond to individual user enquiries.

AO3 is expected to remain offline for at least two weeks, with the recovery process potentially taking up to four weeks. The team said it was hopeful the website could return sooner in a degraded state, potentially with limited features or read-only access.

However, users have been warned that the platform may need to be taken offline unexpectedly during recovery if further work is required.

The team reiterated that it would provide further information as it becomes available, with its next update expected once there is more to share about the investigation and restoration of services.