Fan fiction site AO3 says it could take two to four weeks to restore service after a security incident; AO3 hosts 18M+ works and has 11M+ registered users

If you use the same password for AO3 as on other websites, you must change those other passwords now.

The fanfiction website Archive of Our Own (AO3) has been offline since October 29 due to a detected security incident. Its operator, the nonprofit Organization for Transformative Works (OTW), stated on October 30 that service could be unavailable for two to four weeks as they investigate the scope of the incident. While OTW confirmed that user-created works, bookmarks, and kudos remain safe and no data deletion occurred, they cannot rule out unauthorized access to the user database. This database may contain usernames, email addresses, IP addresses, and hashed passwords. OTW advises users who reused their AO3 passwords on other sites to change them, as hashed passwords, while scrambled, could be vulnerable if weak or reused. The site may return sooner in a limited, read-only state, with potential for further unexpected downtime during recovery.

This incident highlights the persistent vulnerabilities faced by large, user-generated content platforms, even those with nonprofit structures. The potential exposure of user credentials, however hashed, raises concerns about broader credential stuffing attacks, affecting users across multiple online services. The extended downtime and potential for a degraded service also underscore the operational challenges and resource constraints that many such platforms grapple with, particularly when facing sophisticated security threats.

The OTW's proactive communication and advice regarding password reuse demonstrate a commitment to user security amidst a significant breach. However, the investigation's open-ended nature and the possibility of partial service restoration indicate a complex recovery process. This situation may prompt other fan communities and similar platforms to reassess their security protocols and incident response plans, potentially leading to more robust defenses and user awareness campaigns across the digital fan landscape.