> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:
First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments.
Oct 30, 2026 - 01:27 UTC
"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."
Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.
I'm certain many people signed up using established internet identities which can then be linked to real world identities through social engineering techniques.
I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.
It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.
If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.
At this point it’s all public. Everything you do on the internet is or will be public.
I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.
I think we are approaching a future where no one will care. An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge. And nothing happened because everyone has embarrassing teenage past actions.
My memory of it is fuzzy but I feel like that exemplifies the point more. No one really faces any consequences for this stuff leaking unless it’s truly bad. After all these hacks everyone is going to have embarrassing details leaked but it probably won’t matter.
>Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks.
That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.
> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
wmf | 11 hours ago
swyx | 11 hours ago
First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments. Oct 30, 2026 - 01:27 UTC
rahidz | 11 hours ago
Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.
echoangle | 11 hours ago
lunar_rover | 10 hours ago
UqWBcuFx6NV4r | 9 hours ago
Gigachad | 7 hours ago
Sure it’s possible to have perfect op sec but almost no one does in reality.
KPGv2 | 7 hours ago
ashleyn | 9 hours ago
If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.
Gigachad | 7 hours ago
I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.
whoanoway | 7 hours ago
Gigachad | 7 hours ago
noritori | 5 hours ago
He was a teacher at the time, at West Point Grey Academy, not a teenager. [1]
I'm not saying people can't grow and make mistakes throughout their life, and become better people, but it was definitely not a teenage mistake.
[1]: https://www.cbc.ca/news/politics/canada-votes-2019-trudeau-b...
Gigachad | 5 hours ago
8cvor6j844qw_d6 | 6 hours ago
culi | 11 hours ago
Zambyte | 11 hours ago
Suppafly | 4 hours ago
That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.
MattGaiser | 11 hours ago
Lapalux | 11 hours ago
erelong | 11 hours ago
if something happens, it's probably not your fault?
UqWBcuFx6NV4r | 9 hours ago
tialaramex | 10 hours ago
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
tbrownaw | 9 hours ago
UqWBcuFx6NV4r | 9 hours ago
tbrownaw | 8 hours ago
Starlevel004 | 9 hours ago
Yes, because all of those teenage fanfiction readers are going to have yubikeys.
danielmeskin | 8 hours ago
Gigachad | 7 hours ago
blurbleblurble | 9 hours ago
ChrisArchitect | 8 hours ago