Archive of Our Own, the giant fan-fiction library better known as AO3, has gone dark, and the people who run it now say the outage follows a security incident. The site could stay offline for up to four weeks.
AO3 is run by the Organization for Transformative Works (OTW), a nonprofit. Xarmo couldn't check the OTW's own announcements against a registered first-party source, so every detail below is attributed to the outlets that reported it: TechCrunch, 404 Media and Engadget.
From maintenance to "security incident"
According to Engadget, the OTW took AO3 offline just after 3 AM ET on Thursday, October 29, and at first planned for about 12 hours of downtime. TechCrunch reports that the site went down during what was supposed to be routine overnight maintenance and that, at first, nobody said what had caused it.
That changed in a longer statement later the same day. TechCrunch quotes the OTW: "Earlier today, we detected evidence of a security incident on AO3." The OTW added that its response was still in its early stages, and that AO3 will stay offline while it investigates, TechCrunch reports.
The timeline grew with it. Engadget quotes the OTW's status account: "We estimate that service restoration for #AO3 will take around 2 weeks but it could be up to 4 weeks." According to 404 Media, the OTW said it hoped to bring the site back "in a degraded state sooner", with a warning: "If that does happen, there may be times when the site has to be brought down temporarily until this is fully resolved." The OTW posts its updates on its status page.
What about your account?
This is the part that matters most to anyone with an AO3 login, and the honest answer is that the OTW doesn't know yet.
404 Media quotes the OTW's later status update: "while we currently don't believe that the user database was stolen, we are also unable to rule it out." The OTW said that database may hold usernames, email addresses, IP addresses and a hashed version of each password, according to both 404 Media and TechCrunch.
There is some good news in the same update:
- The stories are safe. "No AO3 data has been deleted," the OTW said, and works, bookmarks and kudos are intact, according to 404 Media.
- No real names. The OTW said AO3 doesn't collect real names, and that donor information is kept separately and was not exposed, Engadget reports.
- Passwords are hashed. TechCrunch reports that AO3 uses an industry-standard hashing technique for passwords.
The OTW's precaution is simple: if you used your AO3 password anywhere else, change it on those other sites, according to TechCrunch and 404 Media.
A big library with a small crew
AO3 hosted more than 18.4 million works across over 82,900 fandoms as of September, 404 Media reports. TechCrunch notes that the OTW relies on volunteers and donations, and Engadget reports that its engineers are volunteers rather than paid staff, which may slow down fixes.
What caused the incident hasn't been explained. TechCrunch points out that AO3 is built on Ruby on Rails rather than PHP, so the outage is unlikely to be connected to recently disclosed PHP flaws. Engadget separately reports that the OTW had logged problems with email notifications, search, history and listings on October 23 and 24, but hasn't linked those to the current outage.
The timing stings, too: 404 Media notes the downtime is likely to overlap with the start of what it calls "the month formerly known as NaNoWriMo".
Riley's take: A fan archive run by volunteers just admitted to its readers that it doesn't know yet whether their data was taken, rather than promising everything is fine, and that's the right call. The useful move for anyone with an account is the boring one: if your AO3 password lives anywhere else, retire it there today. The fics will still be waiting when the doors reopen.
Reporting notes
