Short answer
Archive of Our Own went offline on 29 October 2026 for what was first called maintenance. On 30 October its operator disclosed a security incident, said it does not currently believe the user database was stolen but cannot rule it out, and estimated two to four weeks of downtime.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Archive of Our Own (Organization for Transformative Works) |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Fan fiction archive and nonprofit |
| Country | United States |
| Detected | 2026-10-29 |
| Disclosed | 2026-10-30 |
| People or records affected | Not determined. The operator says it does not currently believe the user database was stolen but cannot rule it out |
What data was exposed
- Possibly usernames, email addresses, IP addresses and hashed passwords, if the user database was taken (not confirmed)
- No works, bookmarks or kudos were deleted, according to the operator
What happened
Archive of Our Own, the large fan fiction archive run by the nonprofit Organization for Transformative Works (OTW), went offline on 29 October 2026. Reports say the first notice, early that day, described maintenance expected to last at least 12 hours. Later the same day the estimate rose to about two weeks, and on 30 October the OTW disclosed that it had found evidence of a security incident.
What the OTW says about data
IBTimes UK and Dexerto, both quoting the OTW’s updates, report the same position. The operator does not currently believe the user database was stolen, but it cannot rule that out. It says the database may hold usernames, email addresses, IP addresses and hashed passwords.
The OTW adds that hashing does not fully protect weak or reused passwords. It says AO3 does not collect real names, and that donor information is stored separately and was not exposed. It says no works, bookmarks or kudos were deleted.
Because this is an open investigation, we do not say user data was taken. The status here is “under investigation” and could change.
Outage timeline
IBTimes UK lists the maintenance notice at 07:13 UTC on 29 October, a revised estimate of about two weeks at 17:41 UTC, and the security disclosure at 01:27 UTC on 30 October. Dexerto quotes the AO3 Status account: “We estimate that service restoration for #AO3 will take around 2 weeks but it could be up to 4 weeks.”
On return, the archive may have missing features or run read-only, and recovery work could cause more unannounced shutdowns. IBTimes UK also notes earlier disruptions in October, including delayed notifications and search on 23 October, which the status page marked resolved the next day with no data lost. Neither outlet links those to the incident.
What to do
The main risk is password reuse. If your AO3 password matches one used elsewhere, change it there now. See our data breach checklist and the guide to account takeover. While the site is down, fake “AO3 account verification” messages are a likely lure, so read our guide to phishing messages and rely only on the official status channels.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails and messages posing as AO3 or the OTW that ask you to log in to 'verify your account' while the site is down.
- Credential stuffing against other sites if you reused your AO3 password and it was exposed.
- Extortion or doxxing threats aimed at fandom accounts that cite a username or email address.
What to do if you are affected
- 01Change your password on any other site where you used the same password as on AO3.
- 02Turn on two-factor authentication for the email address you used on AO3.
- 03Ignore emails or direct messages about AO3 that contain login links, and rely on the official AO3 Status account and OTW site for updates.
- 04Keep any downloaded copies of your own works, since there is no firm reopening date.
- 05Do not expect replies to individual questions. The OTW says it may be unable to answer them.
Frequently asked questions
Was the AO3 user database stolen?
The OTW says it does not currently believe so, but it cannot rule it out while the investigation continues. Treat the question as open.
What could be in the database?
The operator says it may contain usernames, email addresses, IP addresses and hashed passwords. AO3 does not collect real names, and donor details are held in a separate system the OTW says was not exposed.
Were any stories deleted?
No. The OTW says the outage was not caused by data deletion and that works, bookmarks and kudos remain safe.
When will AO3 come back?
The OTW's estimate is a minimum of two weeks and possibly up to four from 29 October. It may return in a limited or read-only state, and further downtime without warning is possible.
Sources
- Fanfic Site AO3 Could Be Offline for up to 4 Weeks After 'Evidence of a Security Incident', IBTimes UK, 2026-10-30
- Fanfiction library AO3 could remain offline for up to four weeks after security incident, Dexerto, 2026-11-01
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.