The Organization for Transformative Works said on its status site Oct. 30 that it had detected evidence of a security incident on Archive of Our Own and would keep the fan-fiction archive offline while it investigates¹.

OTW said the response was in early stages and that the site would remain down while it determines the incident's scope¹. AO3 is listed in major outage on the same status page¹.

No AO3 data has been deleted, the organization said, including works, bookmarks and kudos¹. It said it does not currently believe the user database was stolen but cannot rule that out¹.

The AO3 database contains account information that may include username, email address, IP address and a hashed password, OTW said¹. It said passwords are stored with industry-standard hashing that cannot easily be reversed, but that weak or reused passwords can still be cracked, and it recommended changing passwords on other sites where the same password was used¹.

AO3 does not collect real names, OTW said, and donor records sit in a separate system that is never linked to AO3 and has not been exposed¹.

OTW said it may not answer individual user inquiries and asked people to watch official outlets¹. It said its current expectation is that AO3 will be down for a minimum of two weeks and possibly up to four, with a chance of a degraded or read-only return that could still be taken down again¹.

The status page had first listed AO3 as down for maintenance on Oct. 29, then estimated a roughly two-week restoration, before the Oct. 30 security-incident update¹. OTW did not name an attacker, a vulnerability or confirm that account records left its systems¹.

Sources

1. otwstatus.orgArchive of our own (AO3) hackedOct 29, 9:27 PM

Read the original at otwstatus.org ↗