---
title: "AO3’s Security Breach Will Keep 18.5 Million Fanfics Offline for Weeks"
description: "A volunteer-run archive with no dedicated security staff is now doing incident response at a scale built for a Fortune 500 company"
author: "Luis Goa"
published: 2026-10-30T18:51:02Z
modified: 2026-10-31T02:59:03Z
url: https://rews.cc/a/ao3-s-security-breach-will-keep-18-5-million-fanfics-offline-c40088
language: en
tags: ["ao3", "fanfiction", "security", "otw", "kinktober", "tech"]
publisher: "Rews (https://rews.cc)"
---

# AO3’s Security Breach Will Keep 18.5 Million Fanfics Offline for Weeks

*A volunteer-run archive with no dedicated security staff is now doing incident response at a scale built for a Fortune 500 company*

By Luis Goa · October 30, 2026 · https://rews.cc/a/ao3-s-security-breach-will-keep-18-5-million-fanfics-offline-c40088

## In brief

- AO3 went offline Oct 29 for what OTW first called maintenance, then confirmed as a security incident
- Outage expected to last 2 to 4 weeks (14 to 28 days); no work data deleted, per OTW
- User database (usernames, emails, IPs, hashed passwords) may be exposed; OTW can’t yet rule out theft
- OTW clarified the outage is unrelated to the separate PHP2Shell vulnerability crisis hitting other sites
- AO3 hosts 18.47M+ works across 82,900+ fandoms for 11.3M registered users, run by ~700 volunteers

Archive of Our Own went down at 07:13 UTC on October 29 for what its status page called routine maintenance. By 17:41 the same day, the estimate had grown from “at least 12 hours” to two to four weeks. By 01:27 UTC on October 30, the Organization for Transformative Works, the all-volunteer nonprofit that runs the site, confirmed why: a security incident, still being scoped, as its status updates show.

**How AO3's outage escalated** Timeline of OTW status updates, UTC

| From | To | How |
| --- | --- | --- |
| Oct 29, 07:13 *("Down for maintenance")* | Oct 29, 09:03 *("At least 12 hours")* |  |
| Oct 29, 09:03 *("At least 12 hours")* | Oct 29, 17:41 *(Estimate revised to 2–4 weeks)* |  |
| Oct 29, 17:41 *(Estimate revised to 2–4 weeks)* | Oct 30, 01:27 *(Security incident confirmed)* |  |

Based on [OTW Status](https://www.otwstatus.org/)

That is a four-fold escalation of the stated timeline in under 24 hours, which is the usual shape of an incident where the first report (‘maintenance’) is written before anyone has looked hard enough to know it’s actually a breach. OTW’s [October 30 update](https://www.transformativeworks.org/update-on-ao3-downtime-october-30-2026/) says “no AO3 data has been deleted” — works, bookmarks, kudos are intact — but on the question that matters for 11.3 million registered accounts, the organization hedges precisely: it does “not believe” the user database was stolen but is “unable to rule it out.” That database, per the same statement, can hold a username, an email address, an IP address and “a hashed version of your password.”

Hashing is not encryption. A hash is a one-way function: run a password through it and you get a fixed-length string that can’t be reversed back to the password, but the same password always produces the same hash, which is why a leaked hash file can still be cracked offline, password by guessed password, given enough compute. OTW’s statement acknowledges this directly, saying “industry-standard techniques” for storage don’t change the fact that “no hashing method can fully protect a weak or reused password.” The practical advice follows from the mechanism, not from caution for its own case: change the password anywhere else you used the same one, because that’s the account a cracked AO3 hash actually threatens.

Donor records, OTW says, sit in a separate system never linked to AO3’s account database, and the org doesn’t collect real names at all, so neither is exposed by this incident even in the worst case. That’s a narrower blast radius than the database breach alone implies, and it’s a design choice, not luck: a site that never asked for your real name has nothing to leak that would deanonymize 11.3 million mostly pseudonymous accounts.

## Why this isn’t the PHP thing

The timing invited a specific wrong guess. The last two weeks of October saw a scramble across the web after the NSA and European cybersecurity agencies warned of two critical PHP flaws — CVE-2026-109618 and CVE-2026-109619, chained into an exploit tool called PHP2Shell that can run arbitrary code on an unpatched server with no login required. PHP runs an estimated 70% of websites, the flaws affect every PHP release back to version 5.4, and researcher Silas Cutler put as many as 1.3 million hosts at risk; CISA added both CVEs to its Known Exploited Vulnerabilities list on October 26 after confirming active exploitation. Wikipedia, 4chan, Something Awful, Asana, GOG and multiple EU government sites all went offline as a precaution during the patch rush. AO3 runs on Ruby on Rails, not PHP, and an OTW representative told CNET plainly that the outage “is not related to the PHP security issue.” The two stories share only a week, not a cause — a distinction worth keeping straight, because it’s easy to let one plausible explanation stand in for one you haven’t checked.

This also isn’t AO3’s first forced outage. In July 2023 the site was knocked offline for roughly 29 hours by a distributed denial-of-service attack that the group Anonymous Sudan claimed credit for, demanding a $30,000 Bitcoin ransom OTW was never likely to pay; cybersecurity firm CyberCX assessed the group as likely Russian-linked rather than the religiously-motivated hacktivists it presented itself as. A DDoS attack and a security breach are different failure modes — one floods a server with junk traffic until it falls over, which is loud, visible and over once the attacker stops or gets filtered; the other is a quiet intrusion that has to be found, scoped and closed before the site can safely come back, which is why this outage is already projected to run 11 to 22 times longer than 2023’s.

## What a volunteer org is running

AO3 is not a startup with a security team on call. It’s maintained by roughly 700 volunteers across committees for things like tag wrangling and abuse policy, funded by donations — OTW reported $512,359 in fundraising revenue against $290,688 in expenses in 2022, figures confirmed in its public financial filings. Those are the economics of a mid-sized nonprofit running infrastructure for a site with 11.3 million registered users and, as of September, more than 18.47 million hosted works across upwards of 82,900 tagged fandoms. The gap between that budget and that user base is the whole story of why this is taking weeks rather than hours: there’s no incident-response retainer, no dedicated forensics team on staff, and the people doing this work are volunteering their time on top of whatever else they do.

[Reporting in 404 Media](https://404media.co/ao3-down-outage-reactions/) by Samantha Cole captures what the outage looks like from the user side rather than the server side. It landed in the middle of Kinktober, AO3’s annual October tradition of posting a new chapter daily against prompts — timing bad enough that multiple writers told Cole they were racing to finish Halloween-timed fics when the maintenance notice hit. Some are migrating mid-story: one writer posting as Selkie Myth is serializing on Space Battles instead, planning to backfill AO3 once it returns, saying “I anticipate the same is true for a lot of other authors.” Sufficient Velocity put up a banner welcoming “AO3 refugees”; Wattpad, a site much of the AO3 community actively dislikes, posted on X that it was “here to support you during this difficult time” and was met mostly with replies telling it to go away.

The harder case is writers with long work mid-serialization who have nowhere comparable to post. A writer going by Ren told Cole she has two in-progress fics — one a 130,000-word *Pokémon* story — that can’t simply be dropped onto Tumblr without the hundreds of thousands of words of context new readers would need. Her plan, absent AO3, is to let the works go on hiatus, since her readers are “used to hiatuses at least.” That’s a single point of failure most of the fandom’s output runs through: discovery, tagging, comment threads and bookmarking all live on one site, maintained by volunteers, now doing incident response on a breach whose scope OTW itself hasn’t yet nailed down. The next status update is the thing to watch — specifically whether it upgrades “unable to rule out” into a confirmed number of exposed accounts, or downgrades the two-to-four-week estimate in either direction.

## See also

- [OTW Status page](https://www.otwstatus.org/) — otwstatus.org · Live timeline of status updates on the incident
- [Widespread PHP Flaw May Cause Many Site Outages Today](https://krebsonsecurity.com/2026/10/widespread-php-flaw-may-cause-many-site-outages-today/) — krebsonsecurity.com · Background on the unrelated PHP2Shell vulnerability crisis
- [Archive of Our Own](https://en.wikipedia.org/wiki/Archive_of_Our_Own) — en.wikipedia.org · History, user/work counts and 2023 DDoS attack details
- [AO3 shut down by Anonymous Sudan extortion attempt](https://cybernews.com/news/ao3-shut-down-extorted-anonymous-sudan/) — cybernews.com · Account of the 2023 DDoS and ransom demand