What happened to AO3?
Archive of Our Own went offline on 29 October 2026. The site, known as AO3, is one of the largest fan-fiction archives on the web and a project of the nonprofit Organization for Transformative Works.
The first public notice sounded routine. At 09:04 UTC, AO3's status page said maintenance was in progress and would take at least 12 hours. The same message went out on the archive's official Bluesky account.
Eight hours later, the estimate changed. At 17:41 UTC, OTW said restoration would take about two weeks and might take up to four.
October had already been uneven. CNET reported a series of intermittent disruptions during the month. TechCrunch said the archive went offline for what was supposed to be routine overnight maintenance. The gap between the first notice and the security disclosure was about 16 hours.
The reason for the change arrived early on 30 October. At 01:27 UTC, OTW said it had 'detected evidence of a security incident on AO3'. The statement added that the organisation was 'still in the early stages of response' and that the archive would stay closed during the investigation.
OTW has not named an attacker, described the intrusion method or confirmed which systems were reached. Its statement says no AO3 data has been deleted and that works, bookmarks and kudos are safe.
The site was still offline when this article was published, more than a day after the maintenance notice. OTW says it will post further updates on its status page and official accounts. The notice also warns that the organisation 'may be unable to respond to individual inquiries from users'.
When will AO3 be back online?
There is no confirmed date. The status page gives a range: 'a minimum of two weeks', with a worst case of four weeks.
That estimate is not a guarantee. OTW says it is 'hopeful' it can restore a degraded version of the site sooner than the full fix. In degraded mode, 'not all features will be available and/or the site may be read-only'.
The wording matters for readers and writers. A read-only archive would let people open works but probably block posting, commenting and kudos; OTW has not published a feature list. OTW also warns that a partial restore might be followed by more unplanned downtime while repairs continue.
For writers who publish on a schedule, that leaves no reliable date. OTW has not said whether links, downloads or email notifications will work in a partial restore, and its updates do not include a timetable for the degraded version.
The scale of the site explains the caution. AO3 reported 18 million fanworks in July 2026 and 11 million registered users in June 2026, both figures from its own announcements. Every hour offline affects readers, writers and the volunteer teams that process tags, reports and imports.
Past outages were shorter. A wave of distributed denial-of-service attacks in July 2023 kept AO3 offline for 28 hours, according to a Cloudflare case study. IGN noted that a March 2026 incident lasted three days. Neither was described as a breach of the archive's own systems.
The estimate is also unusual. TechCrunch described a shutdown that began with 'routine overnight maintenance', a phrase that usually implies hours rather than weeks.
Was the AO3 user database stolen?
This is the question OTW cannot yet answer. Its statement says the organisation does not believe the user database was taken, but it does not rule it out. Its update says that 'we currently don't believe that the user database was stolen, we are also unable to rule it out'.
OTW has described what the database may contain: usernames, email addresses, IP addresses and a hashed form of each password. It says AO3 does not collect real names, so legal identities are not stored. Donor records sit in a separate system that is 'never linked to AO3'.
IP addresses deserve attention. A login record can tie a pseudonymous account to a household, and an archive that avoids real names still holds that link. If the database was exposed, the risk is cumulative: one email address can connect a fan account to other services.
Password hashing reduces risk but does not remove it. OTW says it uses 'industry-standard techniques' to store passwords in a scrambled form, while acknowledging that 'no hashing method can fully protect a weak or reused password from being cracked'. The advice that follows is practical: change the same password anywhere else it is used.
Reuse is the bigger danger, which is why OTW's advice points at other sites rather than at AO3 alone. The archive cannot process a password reset while it is offline, which leaves users with a waiting period.
No evidence of a data sale has been published. Reporting from TechCrunch, CNET, The Verge and IGN describes an investigation with an unknown scope, and none of those outlets cites a ransom demand or a leak site. OTW has not confirmed an intrusion vector.
The absence of an attacker claim is notable. In 2023, a group calling itself Anonymous Sudan took credit for a DDoS attack on AO3 and demanded a ransom, and OTW urged users to view the claim with skepticism. No similar claim has surfaced in the coverage reviewed for this article.
The organisation has recent experience with a confirmed breach on another project. In August 2026, OTW identified unauthorised access to the Fanlore wiki it operates, and Have I Been Pwned lists 145,000 unique email addresses exposed with usernames and passwords stored as MD5 or PBKDF2 hashes. OTW submitted the data itself, according to the breach service. There is no public indication that the Fanlore breach and the AO3 outage share a cause.
OTW has not said whether it will notify users if the database is confirmed exposed. For now, the status page is the only reliable check.
Is the outage linked to the PHP vulnerability?
The timing invited speculation. The outage began days after two critical flaws in PHP, the programming language that powers a large share of the web, were disclosed. TechCrunch raised the possibility of a connection before noting that AO3 runs on a different framework.
OTW has ruled that theory out. A representative told CNET that the downtime is 'not related to the PHP security issue as the Archive uses Ruby on Rails'. Ruby on Rails is a separate framework, so a PHP flaw would not apply directly to AO3's application code.
That denial is useful, but it is not a diagnosis. Security incidents can start with a vulnerable dependency, a stolen credential, a misconfigured server or a compromised account. OTW has not said which of these, if any, it is examining.
Cloudflare's case study says the systems volunteers follow industry trends and patch as appropriate, which is the routine work that keeps a small stack current. The wider trend adds pressure. TechCrunch reported that the PHP flaws were uncovered with AI tools, a pace of discovery that small teams can struggle to match.
The episode also shows how quickly unrelated bugs enter an outage story. In the first day, a plausible explanation spread through coverage before the operator addressed it. OTW's short denial did more to narrow the story than any outside analysis.
Why does an outage at a fan-fiction archive matter?
AO3 is not a social feed with a substitute down the road. It is an archive built to keep works online, and it holds more than 18 million of them.
Preservation is part of the job. OTW's Open Doors project keeps importing older archives into AO3; a September announcement described a Harry Potter fan fiction and fan art collection moving to the site.
The site is run by OTW, a nonprofit founded in 2007, and depends on volunteers and donations. Cloudflare's case study of the organisation describes a systems team that patches servers and fights attacks without the budget of a commercial platform. 'As a solely volunteer-driven organization, we do not have the same resources as some for-profit organizations,' the OTW systems chair told Cloudflare.
Users fund the operation. OTW's October 2026 membership drive raised US$314,539.76, according to the organisation's own announcement. The Verge described the parent organisation in 2023 as 'entirely supported by user donations and run by volunteers'.
The cultural role is older than the website. Henry Jenkins's Textual Poachers, published in 1992, described fan communities that treated stories as shared, participatory culture rather than passive consumption. AO3 turned that idea into infrastructure: a nonprofit home for derivative writing that commercial platforms had little reason to keep.
What it holds is hard to replace. Fan fiction is often written outside publishing, and works can vanish when a platform closes or changes its rules. During an outage, readers lose access, and writers lose the comments, kudos and bookmarks that sustain a fandom. IGN noted that reading copies through the Wayback Machine or local downloads does not credit authors with those interactions.
That makes the archive a shared reference point. Reading lists, fan wikis and recommendation threads link to AO3 work pages, so a shutdown breaks those trails as well as the stories.
The site's infrastructure has absorbed serious attacks. Cloudflare says the 2023 DDoS reached 1.5 million requests per second at the peak, with up to 1.2 Tbps of layer 3 traffic hitting the organisation's data centre. OTW joined Cloudflare's Project Galileo and mitigated more than 7 billion abusive requests in roughly 10 hours, according to the case study.
In 2023, OTW's spokesperson told The Verge that volunteers were taking measures against the attack and that there was no timeline for consistent service. The current updates follow a similar pattern: short, factual and without technical detail.
Centralisation is the quiet risk. When one volunteer-run archive holds a large share of a culture's writing, its downtime becomes a collective loss, and its recovery speed depends on donated labour rather than a corporate incident team.
What should AO3 users do while the site is down?
Start with passwords. If the AO3 password was reused elsewhere, change it on those other accounts now, because the archive cannot process a reset while it is offline. Turn on two-factor authentication wherever a service offers it.
Check the address bar before typing credentials. The real archive is archiveofourown.org and it is offline, so any page asking for AO3 login details right now is not the archive.
Expect phishing. Outages create openings for messages that promise account recovery, early access or compensation for lost data. OTW says it will publish updates through its official channels, and the status page is the primary source. Treat any email or direct message that redirects you to a login page with suspicion.
For reading, downloaded copies still work. The Internet Archive's Wayback Machine may hold snapshots of some work pages, though coverage is uneven. Both routes skip the kudos and comments that a normal visit would generate, as IGN pointed out.
Keep a local copy of works you rely on. Downloads made before the outage are unaffected, and they are the only version a reader controls.
Be careful with rumours. The breach status is unresolved and no confirmed list of exposed accounts exists. Claims that a specific database is for sale should be treated as unverified until OTW or a breach-notification service confirms them.
What to watch in the next four weeks
The first signal is OTW's next status update. A move from an estimate to a firm date, or an announcement of a read-only restore, would show the recovery is progressing.
The status page still labels the incident 'AO3 Down for Maintenance', even though OTW has described it as a security incident. A change in that label would be a small signal that the investigation has moved on.
The second is the scope statement. A confirmation that the database was accessed would trigger password resets and breach notifications. A clear denial would narrow the incident to availability and infrastructure.
The third is whether OTW publishes a post-incident report. The 2023 DDoS response set a precedent for explaining an attack in public. A technical write-up would help other small archives prepare.
Speed is possible. In 2023, OTW was back online within three hours of applying to Cloudflare's Project Galileo, according to the case study. A forensics-led recovery is a different kind of problem.
The fourth is capacity. AO3 runs on donated infrastructure and volunteer labour, and this outage follows a difficult year that included the Fanlore breach and repeated disruptions. Whether OTW changes its security posture, or asks donors for more, will shape how quickly the archive recovers.
For now, the facts are narrow. A major archive is offline, its operator says a security incident caused the shutdown, restoration may take a month, and the status of user data is unresolved. Everything beyond that remains under investigation.