Archive of Our Own (AO3) could remain offline for up to four weeks after its operator, the Organisation for Transformative Works (OTW), detected evidence of a security incident.
The organisation said it could not rule out the possibility that the site's user database had been stolen, although it did not currently believe that had happened. The disclosure, published on Friday, 30 October, has added a privacy concern to an outage that initially appeared to be routine maintenance.
AO3 users are now waiting for the platform to return while OTW investigates what happened and determines whether account information may have been affected.
AO3 Security Investigation Changes the Outage Picture
The Organisation for Transformative Works, the non-profit organisation behind AO3, first announced on Thursday, 29 October, that the website was down for maintenance. Its initial status update said the work would take at least 12 hours, although it warned that the disruption could last longer.
The estimate subsequently grew. OTW said restoring the platform would take around two weeks, with the possibility that the shutdown could stretch to four weeks.
In its latest update, however, the organisation disclosed that it had found evidence of a security incident. It said the investigation was still in its early stages and that AO3 would remain offline while it worked to address the issue.
OTW has not confirmed that attackers accessed or stole user information. It said it did not currently believe the database had been taken, but was unable to rule out that possibility while the investigation continued.
The database contains account information that may include usernames, email addresses, IP addresses and hashed versions of passwords.
That means the potential exposure could involve information users supplied or generated through their accounts, although there is no confirmed finding that these details have been accessed.
OTW also sought to reassure users that the incident had not resulted in the loss of their creative work. 'No AO3 data has been deleted,' the organisation said, adding that users' works, bookmarks and kudos remained safe.
It also said AO3 does not collect real names. Donor information is held in a separate system that is not linked to the archive, and OTW said that information had not been exposed.
What AO3 Users Should Know About Their Passwords
The possibility of database theft has also prompted a warning about password security. OTW said it uses industry-standard techniques to store passwords in a scrambled form designed to make them difficult to reverse. These techniques are known as hashing.
Rather than keeping passwords in a form that can simply be read, a system stores a transformed version that is intended to make recovering the original password difficult. That protection does not make every account invulnerable. OTW warned that weak passwords or credentials reused across multiple websites could still be vulnerable to cracking.
As a precaution, it recommended that users change passwords on other websites if they had used the same password for their AO3 accounts. The advice is particularly relevant because a reused password could put accounts on other services at risk if credentials were ever compromised.
The organisation has not said that AO3 passwords have been leaked, and there is no confirmed public finding that the user database was stolen. Its warning is precautionary rather than confirmation of a breach.
Archive of Our Own Could Return With Limited Features
The extended shutdown affects a platform that has become a major part of online fan culture. As of September 2026, AO3 hosted more than 18.4 million works across over 82,900 fandoms, giving readers and writers a shared archive for fanfiction and other fan-created material.
Its absence is likely to be felt by people who use the site to publish stories, follow ongoing works or revisit saved collections. The timing also overlaps with the Halloween period and the start of November, when many writers and readers are active in online fan communities.
OTW has not ruled out restoring access before the full recovery is complete. It said it hopes to bring AO3 back in a degraded state, which could mean that some features would be unavailable or the site would operate in read-only mode.
That would not necessarily mean the disruption was over. The organisation warned that it might need to take the platform offline again temporarily as recovery work continues.
For now, OTW has not provided a confirmed date for AO3's return. It said it would publish another update when more information becomes available, while warning that it may be unable to respond to individual user enquiries during the investigation.
