Particle.news

AO3 Taken Offline for Weeks After Security Incident

The volunteer nonprofit running the site says it detected a breach and will remove attacker access before restoring service.

Overview

  • AO3 went down for maintenance on Oct. 29 and the Organization for Transformative Works now estimates full service will take about two weeks and could take up to four weeks to restore.
  • OTW reported evidence of a security incident on Oct. 30, said it is in the early stages of investigating the scope, and warned it cannot yet rule out that user data was exfiltrated.
  • The organization assured users that no content has been deleted and that the archive of works, bookmarks and kudos remains intact.
  • AO3’s user database may include usernames, email addresses, IP addresses, and hashed passwords, and OTW advised users to change reused passwords as a precaution.
  • Millions of readers and writers are locked out and have begun sharing offline copies, posting on alternate platforms, and creating “survival guides,” while volunteers rebuild systems and archival services face heavy extra load.