Archive of Our Own has been dark since Oct. 29 after a security incident. Here is when it may return, what data was at risk and what to do.
Archive of Our Own, the fan fiction site with more than 18 million works, is still offline after its operators found evidence of a security incident on Oct. 29. The nonprofit Organization for Transformative Works says restoring the site is going well and its estimate still holds: at least two weeks, possibly four, so a return around mid-to-late November. A read-only version could come first, and the site might have to go down again during recovery.
No stories, bookmarks or kudos were deleted. But the OTW can't rule out that usernames, email addresses, IP addresses and hashed passwords were taken, so it advises changing any password you reused from AO3 on other sites.
Is AO3 back up? Not yet. Archive of Our Own, the giant fan fiction site with more than 18 million works, has been offline since Oct. 29, and its nonprofit operator says the original estimate still stands: at least two weeks, and possibly as long as four.
That points to a return somewhere between mid-November and late November, with a chance of a limited, read-only version before then. The reason for the long wait is a security incident, not a broken server, and it means the volunteers who run the site won’t switch it back on until they’re sure the hole is closed. If you have an account, there’s one password step worth taking today, and it isn’t on AO3 itself.
As of this writing, AO3 is still down, and the official status page lists it as a major outage. The Organization for Transformative Works (OTW), the nonprofit behind the archive, posted its most recent update in early November. It said the work to restore the site, and to make changes that should prevent a repeat, is going well, and that it still believes its first estimate for a return is accurate.
The OTW’s other projects are unaffected. Its status page shows Fanlore, the fandom wiki, the academic journal Transformative Works and Cultures, and the OTW’s own website all running normally.
The OTW has also warned that the comeback may be bumpy. It said it might bring AO3 back in a degraded state first, where some features are switched off or the site is read-only, and that it could have to take the site down again without warning while recovery continues.
The latest update also cleared up two things users had been worried about:
AO3 first went offline on the morning of Oct. 29 with a short maintenance notice, and the team initially expected the work to take 12 hours or a bit longer. Within hours, the estimate jumped to around two weeks and up to four. Later that day, the OTW explained why: it had found evidence of a security incident and was still working out how far it reached.
The OTW hasn’t said how the attackers got in. One theory that spread online linked the outage to the recently disclosed critical flaws in PHP, a programming language that powers a huge share of websites. That link looks unlikely, because AO3 runs on Ruby on Rails, a different toolkit for building websites.
Why so slow? AO3 has no paid staff. The OTW has zero employees and relies on a team of about 1,000 volunteers, plus donations. Rebecca Tushnet, an OTW founder who co-chairs its legal committee, said the team is being very careful and won’t restore anything until it is confident the problem has been patched. She called it the biggest outage since the archive opened to the public in November 2009.
It isn’t the first attack on the site. In July 2023, a group calling itself Anonymous Sudan knocked AO3 offline for 28 hours with a flood of junk traffic, known as a DDoS attack.
The good news first. The OTW says no AO3 data has been deleted, so your works, bookmarks and kudos are all safe and should be there when the site returns.
The less good news is that the OTW can’t rule out that its user database was stolen, even though it doesn’t currently believe it was. That database can hold:
AO3 never collects real names, so those can’t leak. Donor details live in a completely separate system that isn’t linked to AO3, and the OTW says that data was not exposed either.
Here is the step that matters. The OTW says it stores passwords using industry-standard scrambling, but no method can fully protect a weak password or one you reuse. So it recommends a precaution: if you used your AO3 password on any other site, change it on those sites now.
The outage has opened a second front. Soon after AO3 went dark, clone sites such as AO3.life appeared, filled with stories that seem to have been scraped from the archive without permission. On AO3.life, many of those stories were turned into AI-generated audiobooks and listed for sale. Some of the biggest clones have since shut down after a wave of takedown notices.
This has happened before. In 2024, sellers on Etsy scraped works from sites like AO3 and printed them as physical books, with some priced as high as $100.
Naomi Novik, an AO3 co-founder, has blamed AI companies more broadly, arguing in an interview that their carelessness means almost the whole tech industry is under attack at once and rushing to ship fixes, which is especially hard for a volunteer group. There is no official confirmation that AI played any part in the AO3 breach itself.
Fans have also built shared folders and Google Docs of downloaded stories, billed as survival guides. Some authors are unhappy about it. They point out that AO3’s download feature was meant for personal offline reading, and that they never agreed to their work being reposted elsewhere, where AI tools might scan it.
Once you have dealt with reused passwords, here’s what you can do in the meantime:
Fandom hasn’t gone quiet, either. Tumblr says new sign-ups rose 49 percent between Oct. 29 and Nov. 2 compared with the two weeks before, and by 75 percent among users aged 18 to 25. The company shared percentages only, not raw numbers, so it’s too early to say whether the move will last once AO3 returns.
The scale explains the panic. AO3 hosts more than 18 million works across over 83,000 fandoms, and a 2026 press release put its users at 11 million. Within two hours of the outage notice, the status posts had drawn millions of views across social media.
The OTW expects a minimum of two weeks from Oct. 29 and possibly up to four, which points to mid-to-late November. A limited, read-only version could arrive sooner.
The OTW doesn’t believe the user database was stolen but can’t rule it out. Your stories are safe; change any password you reused from AO3 on other sites.
Yes, if they are kudos or subscription notices. The OTW says queued notifications from before the outage were released and are genuine.
You're reading the quick version.
Read next
GPT-6.1 Sol or Terra? Which to pick, and what each one costs
OpenAI now has two fresh GPT-6.1 models. Sol is the stronger thinker, Terra the fast, cheap worker. Here's how they compare on price, speed, accuracy and access.
Starlink now handles crowded areas with surge-style monthly prices, waitlists and fees. Here's what the capacity message means and what you can do about it.
Prime members can now order Uber Eats inside Amazon with no delivery fee over $25, but service fees remain and the Grubhub perk is gone.
The new top plan costs $90 a month with AutoPay and keeps that price for a decade. Here is who gets it, what the guarantee skips, and the cheaper tiers.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
