Summary
- Environment: Archive of Our Own
- Operational impact: Offline during investigation; two-to-four-week recovery estimate
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed October 30, 2026; updated as evidence emerges.
What happened
The Organization for Transformative Works detected a security incident on AO3 on October 30, 2026 and kept the archive offline while investigating. [1]
Impact
OTW said works, bookmarks and kudos were intact. It did not believe the account database had been stolen but could not rule that out. The database holds usernames, emails, IP addresses and hashed passwords. Separate donor information was not exposed, according to OTW. [1]
Timeline
Incident disclosed; archive remains offline
The OTW update describes the investigation and recovery expectations.
[1]Briefing updated
This briefing was last reviewed and updated on October 30, 2026.
Threat Group & Attack Vector
The intrusion method and affected-user count remain unknown; database theft is unconfirmed. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
OTW estimated at least two weeks and possibly four weeks offline, with potential limited or read-only service during recovery. This is an estimate, not a completed outage duration. It recommended changing passwords reused elsewhere. [1]