conv.

All stories
SecurityQuiet 12d · day 12

AO3 hacked; site down 2-4 weeks, user data at risk

Archive of Our Own confirms security breach, unclear if user database stolen; site remains offline during investigation.

newest coverage 11d agosummary written 11d ago10 pieces130 likes & upvotes41 comments Hacker NewsMastodonNewswires

What to know

  • AO3 took its site offline after detecting a security incident; the scope and full details remain under investigation.
  • User account data including usernames, emails, IP addresses, and hashed passwords may have been compromised, though AO3 cannot yet confirm a database theft.
  • The site is expected to remain down for 2-4 weeks, a timeline that some security experts have questioned as longer than typical for incident recovery.
  • The potential leak poses privacy and harassment risks to users whose fan interests and reading histories could be exposed.

The dispute Whether AO3's 2-4 week downtime reflects legitimate investigative thoroughness or poor incident response preparation. · positions read across 8 posts and comments

many voices

A leaked user database poses serious harm beyond password risk—usernames, emails, and reading histories could enable harassment or exposure.

  • “Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'd/bookmarked?”

    rahidz · Hacker News ↗
some voices

The 2-4 week recovery timeline is unexpectedly long and suggests AO3 lacks professional incident response plans or resources.

  • “That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours.”

    Suppafly · Hacker News ↗
some voices

Security breaches have become routine; the industry faces a persistent and worsening threat landscape.

  • “I guess this is just going to be the next few months/years, as HN right now is just breach after breach.”

    MattGaiser · Hacker News ↗

Archive of Our Own (AO3) Nonprofit fanfiction platformOrganization for Transformative Works OTW, parent organization of AO3

How it unfolded 3 developments, newest first · click a bar or a number to jump articlespostscomments

Peak 7 pieces in 3h at Oct 30, 4 PM; 10 pieces over 12 days (1 article · 2 posts · 7 comments) Oct 30, 4 PM — 7 pieces · 1 article · 2 posts · 4 comments — Hacker News 5, Newswires 1, Mastodon 1Oct 30, 7 PM — 2 pieces · 2 comments — Hacker News 2Oct 30, 10 PM — 1 piece · 1 comment — Hacker News 1Oct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — quietOct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — quietNov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–3
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 8:40 PM ET
  1. 3

    Users question the 2-4 week recovery timeline

    Community members expressed skepticism at AO3's expected 2-4 week downtime, suggesting professional incident response firms could restore service faster.

    “That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours.”
    — Suppafly

    • >Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks.That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in…

      SuppaflyHacker News11d agoview on Hacker News ↗
  2. 2

    Security researchers note potential for large-scale harm from credential leak

    Commenters highlighted the risk that a leaked database of usernames, emails, and reading histories could enable harassment or exposure of users' private fan interests, comparable to past breaches.

    “Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'd/bookmarked? Like a miniature version of the Ashley Madison hack.”
    — rahidz

    • > The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail…

      tialaramexHacker News12d agoview on Hacker News ↗
    3 posts in this stretch →
  3. 1

    AO3 confirms no data deleted but user database theft cannot be ruled out

    AO3 stated that all works, bookmarks, and kudos remain safe, but acknowledged it cannot confirm whether the user database—containing usernames, email addresses, IP addresses, and hashed passwords—was stolen.

    “First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.”
    — Archive of Our Own

    • > Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:First, no AO3 data has been deleted. All…

      swyxHacker News12d agoview on Hacker News ↗
    2 more of the top 3 · 4 posts in this stretch
    • hkrn@mstdn.social

      Archive of our own (AO3) hacked L: https://www. otwstatus.org C: https:// news.ycombinator.com/item?id=5 0310258 posted on 2026.10.30 at 17:17:23 (c=0, p=3)

      hkrn@mstdn.socialMastodon12d agoview on Mastodon ↗

    • I guess this is just going to be the next few months/years, as HN right now is just breach after breach.

      MattGaiserHacker News12d agoview on Hacker News ↗
    all of them →
  4. background

    AO3 detects security incident, takes site offline — Archive of Our Own discovered evidence of a security breach and took the site down to investigate its scope and respond to the incident.

What people are saying 0 voices from 0 sites · best of 8 · verbatim

Still unanswered
  • How was the security incident initially detected?
  • What specific vulnerability or attack vector was exploited?