Archive of Our Own (AO3), the fan-fiction platform run by the nonprofit Organization for Transformative Works (OTW), could stay offline for up to four weeks after what the organization calls a security incident. The site went down for what was supposed to be routine overnight maintenance, then OTW extended the outage to an estimated two to four weeks.
In a statement published hours after the first announcement, OTW said: "Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far." Within two hours of the outage notice, posts on the site's status page had drawn millions of views, according to TechCrunch.
AO3 security incident: what we know
OTW says it does not currently believe the user database was stolen, but cannot rule it out either. According to the organization, that database contains account information that may include username, email address, IP address, and a hashed version of the password.
The site stores passwords with an industry-standard hashing technique, and OTW advised users to change their passwords on any other sites where they may have reused the same one. Engadget reports that AO3's data is intact, citing a former AO3 volunteer who moderates the r/AO3 community, which would mean the stories themselves are safe.
- Outage duration: around 2 weeks estimated, up to 4 weeks possible
- Possible sooner return: OTW hopes to bring AO3 back in a degraded state
- Data: OTW cannot rule out that the user database was stolen
