AO3 Goes Offline for Up to 4 Weeks After Security Incident

Archive of Our Own, the fan fiction platform known as AO3, has taken its service offline after a security incident. The organization behind the site expects the outage to last between two and four weeks while an investigation determines what happened and how far the attackers may have reached.

According to the organization, it found indications of the incident during a downtime window that had been scheduled for maintenance. So far it has found nothing confirming that the user database was stolen, but it says it cannot rule that out until the investigation is complete.

What data could be affected

AO3 stores account information that may include usernames, email addresses, IP addresses and passwords kept in hashed form. If the investigation shows that an unauthorized party accessed the database, some of that information could be at risk.

Signs of a breach do not mean all data was taken. Hashed passwords are also not directly readable in the way plain-text passwords are. Even so, hashing does not remove the need for caution when a leak is suspected.

What users should do

The organization advises anyone who used their AO3 password on other sites to change it there as well. That way, exposure of one account does not make it easier to break into others.

Using a different password for every service limits the damage of incidents like this one, and a password manager can generate and store unique credentials without forcing users to memorize them.

The organization has not yet published final results from the investigation. The announced timeframe is an estimate, and some services may return before the site is fully restored.