What is known
Archive of Our Own (AO3), the fan fiction site run by the nonprofit Organization for Transformative Works (OTW), went down on Oct 29, 2026 for what was first called maintenance. On Oct 30 OTW said it had found evidence of a security incident. The site could stay offline for two to four weeks, maybe back sooner in a read-only or limited state.
OTW says no works, bookmarks or kudos were deleted. It says it does not currently believe the user database was stolen, but it cannot rule that out yet.
What data could be exposed
If the user database was taken, it holds username, email address, IP address and a hashed version of your password.
AO3 does not collect real names. Donor info sits in a separate system and OTW says it was not exposed.
What to do now
- 01If you used your AO3 password anywhere else, change it on those sites first. Hashed passwords can still be cracked when they are short or common.
- 02Turn on two-step login for your email account. That is the one that resets everything else.
- 03Expect fake AO3 account verification or your works will be deleted emails. AO3 will not ask for your password by email. Go to the site yourself when it is back.
- 04If your AO3 email is tied to your real name and you would rather keep your fandom life separate, consider moving AO3 to a separate email when the site returns.
How to check if your email is already out there
OTW has not confirmed any data was taken, so no AO3 dataset is circulating that we know of. You can still see where your email already showed up.
Have I Been Pwned is free and will add AO3 if a dataset ever surfaces and gets verified.
OSINT Pro's email lookup checks known breach and stealer log data for your email, so you can see which other passwords might already be out there and need changing.
OSINT Pro does not have an AO3 dataset.