The fanfiction website Archive of Our Own (AO3) has been offline since October 29, initially due to maintenance that was expected to last 12 hours. This downtime has since been extended, with projections now suggesting a recovery period of two to four weeks.
Security Intrusion Details
On October 30, AO3's volunteer leadership provided an update regarding a security intrusion that led to the site's takedown. The team is currently in the initial stages of assessing the full scope of the incident. They have assured users that the archive content, including bookmarks and kudos, remains intact. Crucially, donor information is stored on a separate system and is therefore safe from the breach.
However, the AO3 team has stated that they cannot rule out the compromise of its user database. This database contains user emails, usernames, IP addresses, and encrypted passwords. As a precautionary measure, users are advised to change their passwords on AO3, particularly if they have reused the same password on other websites.
Expected Recovery and Potential Motivations
During the coming weeks, AO3 anticipates a phased return to service, which may include degraded functionality, such as read-only access, and intermittent downtime. The specific cause of the hack remains unclear.
The article notes that given the sheer volume of user data, including emails and hashed passwords, AO3 could be a target for black market activity. An ideological motivation is also considered a possibility, given fanfiction's strong ties to the women and queer communities.
The author expresses dismay at the attack, characterizing it as "meanspirited" and "just uncalled-for." They position AO3 alongside The Internet Archive and Wikipedia as examples of internet spaces that exist without commercial influence, driven by community value and quality, making the attack particularly disruptive.