---
title: "AO3 security incident"
description: "AO3 remained offline after OTW detected a security incident; possible account-database theft was still being investigated."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-30"
canonical_url: "https://www.ally.security/incidents/ao3-security-incident-2026"
markdown_url: "https://www.ally.security/incidents/ao3-security-incident-2026.md"
stix_url: "https://www.ally.security/incidents/ao3-security-incident-2026/stix.json"
---

# AO3 security incident

OTW expects a prolonged outage while it investigates and recovers the archive.

Last modified Oct 30, 2026 · 1 source

## Summary

- **Environment:** Archive of Our Own
- **Operational impact:** Offline during investigation; two-to-four-week recovery estimate
- **Financial impact:** No confirmed incident cost quantified

## What happened

[The Organization for Transformative Works](https://www.transformativeworks.org/) detected a security incident on AO3 on October 30, 2026 and kept the archive offline while investigating. [1](#source-1)

## Impact

OTW said works, bookmarks and kudos were intact. It did not believe the account database had been stolen but could not rule that out. The database holds usernames, emails, IP addresses and hashed passwords. Separate donor information was not exposed, according to OTW. [1](#source-1)

## Timeline

### October 30, 2026 — Incident disclosed; archive remains offline

The [OTW update](https://www.transformativeworks.org/update-on-ao3-downtime-october-30-2026/) describes the investigation and recovery expectations. [1](#source-1)

### October 30, 2026 — Briefing updated

This briefing was last reviewed and updated on October 30, 2026.

## Threat Group & Attack Vector

The intrusion method and affected-user count remain unknown; database theft is unconfirmed. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

OTW estimated at least two weeks and possibly four weeks offline, with potential limited or read-only service during recovery. This is an estimate, not a completed outage duration. It recommended changing passwords reused elsewhere. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/ao3-security-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Update on AO3 Downtime, October 30, 2026

official · Organization for Transformative Works

<https://www.transformativeworks.org/update-on-ao3-downtime-october-30-2026/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   AO3 security incident: The potentially exposed account database contains usernames, email addresses, IP addresses and hashed passwords. OTW said it does not collect real names and separate donor information was not exposed.
2. **Discovered At · 100% confidence · current**  
   AO3 security incident: 2026-10-30
3. **Affected Organization · 100% confidence · current**  
   AO3 security incident: Organization for Transformative Works
4. **Resulted In · 100% confidence · current**  
   AO3 security incident: OTW said works, bookmarks and kudos had not been deleted. It did not believe the user database was stolen but could not rule this out.
5. **Occurred At · 100% confidence · current**  
   Security incident disclosed; investigation continues: 2026-10-30
6. **Resulted In · 100% confidence · current**  
   AO3 security incident: OTW recommended changing passwords reused on other services as a precaution. No attacker, access method, affected-user count or confirmed database theft was established.
7. **Resulted In · 100% confidence · current**  
   AO3 security incident: OTW detected evidence of a security incident on AO3 and kept the service offline while investigating and determining the scope.
8. **Resulted In · 100% confidence · current**  
   AO3 security incident: Security incident disclosed; investigation continues
9. **Resulted In · 100% confidence · current**  
   AO3 security incident: OTW estimated at least two weeks and potentially four weeks of downtime, with possible degraded or read-only availability and further shutdowns during recovery. This is a forecast, not a completed outage duration.
10. **Disclosed At · 100% confidence · current**  
   AO3 security incident: 2026-10-30

</details>