What happened to AO3 comes down to a security breach. Archive of Our Own, the fan fiction site most people call AO3, is still offline as of Monday, Nov. 9, after its operators found evidence of a security incident during what began as routine maintenance on Oct. 29. The nonprofit Organization for Transformative Works (OTW), which runs it, said in its latest status update on Nov. 6 that restoration is “proceeding well” and that its original estimate of at least two weeks, and possibly up to four, still holds. It says no works, bookmarks or kudos were deleted, but it has not set a return date.
From a 12-hour maintenance window to a security incident
The first sign came early on Oct. 29, when AO3’s status page switched to “down for maintenance.” A couple of hours later OTW said the work would take at least 12 hours. By that afternoon (UTC) the estimate had grown to about two weeks, possibly four. Then came the statement that explained the delay: “Earlier today, we detected evidence of a security incident on AO3,” OTW wrote, adding that it was still working out the scope, TechCrunch and The Verge reported.
OTW has not named a cause or an attacker. TechCrunch noted that some fans linked the outage to recently disclosed flaws in PHP, but AO3 runs on Ruby on Rails, so the outlet said that connection is unlikely. In an interview with CNN, AO3 co-founder Naomi Novik blamed “the irresponsibility of AI companies” for a wave of security work hitting the whole tech world at once. That was her general view of the industry. She did not say AI was behind this particular breach.
What OTW has confirmed and what is still open
OTW’s own updates are the most reliable record, and they leave a few questions open. Here is where each one stands as of Nov. 9.
| Question | What OTW or reporting says | Status |
|---|---|---|
| Were fics, bookmarks or kudos deleted? | “No AO3 data has been deleted,” OTW said on Oct. 30. | Confirmed by OTW |
| Was the user database stolen? | OTW does not currently believe so but is “unable to rule it out.” The database may hold usernames, email addresses, IP addresses and hashed passwords. | Unconfirmed |
| Were real names or donor details exposed? | AO3 does not collect real names, and donor information sits in a separate system that OTW says was not exposed. | Confirmed by OTW |
| Are drafts safe? | OTW said on Nov. 6 it is “actively working to ensure that drafts are not deleted.” | In progress |
| Are the old kudos and subscription emails real? | Yes. OTW says they were queued before the outage and released during restoration. | Confirmed by OTW |
| When will AO3 return? | A minimum of two weeks and up to four, per OTW, possibly in a degraded or read-only state first. | No date given |
The OTW status page lists AO3 under “Major Outage,” while Fanlore, the OTW website and the journal Transformative Works and Cultures are marked operational.
Copycat archives and scraped stories
The outage has caused a second problem inside fandom. CNN reported that some readers uploaded thousands of works to public Google Drive folders, which upset writers who see their stories as belonging to the community. Several clone sites also appeared. One, AO3.life, went up on Nov. 1 with thousands of stories that had been on AO3, and many had been turned into AI-generated audiobooks for sale, according to CNN. Some of the biggest clones were taken down after writers flooded them with takedown notices, and the creator of AO3.life posted an apology identifying himself as a 17-year-old in India.
None of these sites are run by OTW. Its status page asks users to follow its official outlets for news and notes that it may not be able to answer individual questions.
What AO3 users can do now
- If your AO3 password is also used on any other site, change it on those sites. That is OTW’s main precaution, since hashing cannot fully protect a weak or reused password.
- Treat the backlog of kudos and subscription emails as genuine, but be wary of any message asking you to log in to “recover” an account or pay for access. OTW’s updates have not asked users to reset their AO3 passwords.
- Skip mirror sites and apps that claim to offer AO3 content. If you are a writer and find your work on one, CNN’s reporting shows takedown notices have worked against several clones.
- Check status.archiveofourown.org or the AO3 Tumblr for updates instead of timelines passed around on social media.
How long the wait could be
OTW has given a range, not a date. Counting from Oct. 29, the two-week minimum works out to around Nov. 12 and the four-week outer limit to around Nov. 26. OTW warned that if the site returns in a degraded state, it might have to go offline again without notice while recovery continues.
AO3 is large for a volunteer-run project. AFP puts it at more than 11 million registered users and nearly 18 million works, and CNN also cites more than 18 million fanworks. The two outlets differ on the launch year (AFP says 2008, CNN says 2009), so the exact date is unsettled. AO3 won a Hugo Award for Best Related Work in 2019, AFP noted. OTW co-founder Rebecca Tushnet told AFP: “AO3 is not gone! There is no data loss and we look forward to restoring the site as soon as possible.” Novik told CNN she was not worried about AO3 itself and hoped the tech team would not “run themselves ragged to get it up quicker.”
FAQ
Why is AO3 down?
AO3 went offline for maintenance on Oct. 29, and OTW then said it had found evidence of a security incident. The site will stay down while that is investigated and fixed. OTW has not named a cause.
When will AO3 be back up?
OTW has not given a date. Its estimate is at least two weeks and up to four from Oct. 29, which points to roughly Nov. 12 to Nov. 26. It may come back read-only or with some features missing at first.
Was my AO3 data stolen?
OTW says no works, bookmarks or kudos were deleted. It does not believe the user database was stolen but cannot rule it out. That database may include usernames, email addresses, IP addresses and hashed passwords, so change any reused password elsewhere.
Are the AO3 kudos emails I just got real?
Yes. OTW said on Nov. 6 that notification emails queued before the outage were released during restoration and are not a reason for concern.
For more of the stories people are searching for today, browse our trending news hub, or see the latest from our Tech section.
Updated November 9, 2026