Archive of Our Own, one of the world’s largest repositories for fan-created fiction, went offline on October 29, 2026, following a cybersecurity incident. Operators warned users that service restoration could take between two and four weeks as investigators work to determine the full scope of the breach.
The sudden outage plunged millions of readers and writers into an unexpected drought. Running entirely on volunteer labor, the nonprofit Organization for Transformative Works operates the site.
It hosts more than 18 million fanworks across tens of thousands of fandoms, ranging from books and films to global music acts like the K-pop boy band BTS.
What initially appeared to be a routine overnight interruption quickly escalated. The archive’s administrative team announced via its status channel that maintenance would take at least 12 hours. Hours later, the nonprofit published a longer statement revealing that investigators had detected evidence of a security breach while working on the servers.
We estimate that service restoration for #AO3 will take around 2 weeks but it could be up to 4 weeks. We are hopeful that we will be able to bring the site back up in a degraded state sooner. Refer to our status page for updates: https://t.co/YAyyoTDOpE https://t.co/PUWaHF9M8L
Investigators Probe Database Security Risks
As the offline window stretched from hours to potentially a month, the Organization for Transformative Works addressed user data concerns. While administrators confirmed that no user stories, bookmarks, or other content had been deleted or lost, they could not entirely rule out the possibility of a database theft.
While we currently don’t believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
Organization for Transformative Works, via TechCrunch
The organization advised users to update their credentials on any external services where they reused identical passwords. Security disclosures clarified that while passwords undergo an industry-standard hashing transformation, hashing alone cannot protect weak or reused keys from being cracked. At the same time, administrators confirmed that financial donor records are kept in a segregated system and remained entirely unexposed.
Fans Mobilize During Service Blackout
The prospect of a month-long blackout sent distress through social media networks. Fans flooded platforms like X and Reddit with commentary and humor about facing weeks without their primary reading material.
Resourceful readers quickly mobilized to mitigate the disruption. Across various online spaces, community members shared previously downloaded works and helping readers locate other options.
The Wayback Machine noted an immediate surge in traffic. The Internet Archive platform faced an exceptionally heavy load as users scrambled to pull cached snapshots of their favorite works.
Earlier today, we detected evidence of a security incident on #AO3. We are still in the early stages of investigating. No AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe. Learn more at https://t.co/xzGXE5HyaB https://t.co/kv4euoUIRT
Platform Faces Prior Disruptions
Founded in 2008, the platform allows fans to publish, read, and explore fan-created stories based on their favourite books, films, television shows, anime, video games, and celebrities.
Anne Jamison, an English professor at the University of Utah and author of Why Fanfiction Is Taking Over the World, discussed the site in an interview with the New York Times.
In July 2023, the site endured a 28-hour distributed denial-of-service attack claimed by a hacker group called Anonymous Sudan, which targeted the archive over its explicit and LGBTQ+-themed content.
Experts Weigh In On Restoration
Technical experts consulted on the incident noted the unusual scale of the current downtime. Mehdi Daoudi, an expert on internet resilience at LogicMonitor, observed that service disruptions typically last for only a few minutes to a few hours.
Organization representatives stated they are prioritizing safety over speed to ensure all vulnerabilities are patched. A full restoration could require up to four weeks.
Developers are exploring the possibility of launching a degraded or read-only version of the archive sooner, though administrators cautioned that recovery efforts might necessitate further unannounced outages.