> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:
First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments.
Oct 30, 2026 - 01:27 UTC
"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."
Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.
I'm certain many people signed up with their established internet identity which can be linked to their real world identity through social engineering techniques.
I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.
It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.
If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.
At this point it’s all public. Everything you do on the internet is or will be public.
I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.
Tbh it's probably a good idea to have a bunch of different e-mail accounts, at least for all of the professional, personal and other personal things.
There's horror stories of automated systems suspending people's Google accounts and suddenly they can't access their photos and other important data.
Like if you use a password manager and all of the passwords are random, might as well go a step further and at least have separate e-mail accounts for groups of activities.
>Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks.
That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.
> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
28 comments
[ 3.7 ms ] story [ 117 ms ] threadFirst, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments. Oct 30, 2026 - 01:27 UTC
Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.
Sure it’s possible to have perfect op sec but almost no one does in reality.
If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.
I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.
There's horror stories of automated systems suspending people's Google accounts and suddenly they can't access their photos and other important data.
Like if you use a password manager and all of the passwords are random, might as well go a step further and at least have separate e-mail accounts for groups of activities.
That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
Yes, because all of those teenage fanfiction readers are going to have yubikeys.