Tech brief Breaking

AO3 Is Down for Weeks After a Security Incident: Change Any Reused Password

By , Tech Cheat Codes Team

Published Updated 4 min read

Illustration: a padlock resting on a stack of books beside a down-for-maintenance sign
Image: Illustration: Tech Cheat Codes
On this page · 3 sections
  1. What was and wasn't exposed
  2. What to do now
  3. References

Archive of Our Own went dark in the early hours of Thursday, Oct. 29, for what began as routine maintenance expected to take 12 hours. It is still down.

By that afternoon the estimate had grown to two to four weeks. That night, the Organization for Transformative Works, the volunteer-run nonprofit behind AO3, named a security incident as the cause and admitted it could not rule out that the database holding account information had been taken, though it doesn't currently believe it was. Posts on the AO3 status account drew millions of views within two hours of the first announcement, and the outage has since made news at TechCrunch, The Verge, PC Gamer, Engadget and IGN.

Illustration of a padlock over a stack of books with a down-for-maintenance sign

Illustration: Tech Cheat Codes

What was and wasn't exposed

No works, bookmarks or kudos have been deleted. If an attacker did get the user database, it could contain usernames, email addresses, IP addresses and a hashed version of each password. AO3 does not collect real names, so none could be exposed. Donor information sits in a separate system that is not linked to AO3, and that data has not been exposed.

Hashing scrambles a password so it can't easily be reversed, and AO3 uses industry-standard methods. A weak or reused password can still be cracked. A common password, or one you also use on another site, is exactly the kind that holds up worst.

The investigation is in what OTW calls its early stages, and the details of the intrusion haven't been shared. OTW hasn't said how the attackers got in.

What to do now

OTW's advice is to change your password on any other site where you used the same one as on AO3. Start with the email account you gave AO3, because a reused password there would give someone access to every other account that sends resets to that address. If you can't remember whether your AO3 password is one you've used elsewhere, treat it as reused. Then work through banking, shopping and social accounts. A password manager makes unique passwords for each site realistic, and turning on two-step verification where a site offers it covers you if a password does leak. If you want to know whether your email address has turned up in earlier breaches, the free lookup at haveibeenpwned.com shows it in a few seconds.

You can't change your AO3 password while the site is offline. When it returns, changing it costs a minute and removes the question, even though OTW's request is about other sites.

Watch your inbox for messages claiming to come from AO3 or OTW. We found no reports of phishing tied to this incident, but breaches commonly bring it, and a message that links to a password reset page you didn't ask for is a reason to go to the site by typing its address instead. OTW warned it may be unable to answer individual inquiries and will post updates on its official outlets: the status page at otwstatus.org, @AO3_Status on X and the ao3org account on Tumblr.

The same reasoning applies to the stand-in sites fans are using while AO3 is down. A new reading site that wants an account is a new place to lose a password, so don't reuse your AO3 one there.

Two weeks from Oct. 29 is Thursday, Nov. 12. Four weeks is Thursday, Nov. 26, which is Thanksgiving. OTW may bring the site back sooner in a degraded state, with some features missing or the site read-only, and it could have to take the site down again without notice while recovery continues. Authors who see a read-only AO3 come back may want to use that window to save copies of their own work, since there is no promise it will stay up.

As of Saturday evening, Oct. 31, the status page still lists AO3 as a major outage, while OTW's other projects, Fanlore, Transformative Works and Cultures and the OTW website, show as operational. The last incident update was posted Thursday night, and OTW hasn't given a date for the site's return.

References