Fanfic giant AO3 hacked and knocked offline for up to a month
AO3 went down for what looked like maintenance. It turned out to be a security incident, the site may stay offline for four weeks, and a user data leak can't be ruled out.
Archive of Our Own, better known as AO3 and the biggest fan fiction archive in the world, went dark on October 29. At first it looked like routine overnight maintenance, with the team expecting about 12 hours of downtime. Then the estimate jumped to around two weeks, and possibly four.
The reason came later. The Organization for Transformative Works, the volunteer-run nonprofit behind AO3, said it had found evidence of a security incident. It is still working out the scope, so the site stays offline.
The good news: nothing has been deleted. Works, bookmarks and kudos are all safe. The less good news: the team doesn't believe the user database was stolen, but it can't rule it out either. That database holds usernames, email addresses, IP addresses and hashed passwords. Hashing helps, but it won't save a weak or reused password, so users are told to change it anywhere else they use the same one. AO3 doesn't collect real names, and donor data lives in a separate system that wasn't exposed.
The panic was instant: the status posts racked up millions of views within a couple of hours. The archive may come back earlier in a limited, possibly read-only mode, but it could be pulled offline again without warning.
If you had an AO3 account and reuse that password elsewhere, now is a good time to change it.
Tools
Tools
Tools