AO3 confirms a security incident and expects a two-to-four-week outage
AO3 confirms a security incident and expects at least two weeks of downtime, possibly four. It does not currently believe its user database was stolen but cannot rule that out. The operator says works and other AO3 data have not been deleted; donor data is held separately and was not exposed.
- Disclosed
- Oct 30, 2026
- Updated Nov 6, 2026
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- AO3 users, especially anyone reusing an AO3 password on another service
- AO3 · security incident · outage
- In the wild
- Unknown
- Security incident confirmed; user-database theft and the entry point remain unconfirmed.
What happened
If accessed, the user database could expose usernames, email addresses, IP addresses and password hashes. The operator warns that hashing does not fully protect weak or reused passwords. AO3 does not collect real names. The investigation has not established the entry point, affected-account count or database theft. L3 reflects a major platform’s confirmed security disruption, rather than a confirmed mass data leak.
November 6 update: AO3 says restoration and changes to prevent future incidents are proceeding well and the original return estimate still applies. Some subscription/kudos notices queued before the October outage were sent during recovery; the operator confirms those messages are legitimate. The team says it is actively working to prevent drafts from being deleted. These are recovery and communication updates, not confirmation of reopening, completed draft recovery or a resolved database-exposure investigation.
Crime-scene timeline
Oct 29, 07:34 UTC
AO3 announces maintenance downtime
Oct 29, 17:45 UTC
Restoration estimate expands to around two to four weeks
Oct 30, 01:48 UTC
Operator publicly confirms a security incident
Database theft cannot be ruled out; reused-password changes are recommended as a precaution.
Nov 1, 18:10 UTC
AO3 shares an outage-scam warning
The official RSS records this repost time; it adds safety guidance, not a new recovery estimate.
Nov 6, 00:05 UTC
AO3 explains queued notifications and draft-preservation work
Restoration and prevention work continue within the earlier estimate. Some notifications queued before the outage were released legitimately; the team is working to prevent draft deletion. AO3 remains down.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- AO3 official security statementPrimaryRead in full via the public official RSS; security disclosure is October 30, distinct from earlier maintenance notices.
- AO3 official public RSSPrimaryIncludes the complete statement and dated prior maintenance updates; no database theft or deletion is confirmed.
- AO3 official November1 safety repostPrimaryFull repost read through the official public RSS, dated November1 at 18:10:08 UTC; website retrieval was unavailable.
- AO3 official November6 restoration updatePrimaryComplete post read through the official RSS, timestamped November6 00:05:47 UTC; queued emails are legitimate, draft-preservation work continues and AO3 remains down.