The Organization for Transformative Works took Archive of Our Own (AO3) down on Oct 29 and later said it had detected evidence of a security incident. In its Oct 30 update (about 9:27 PM ET Oct 29), OTW says no AO3 data was deleted and works, bookmarks and kudos are safe, but while it does not currently believe the user database was stolen, it cannot rule it out. That database holds usernames, email addresses, IP addresses and hashed passwords. AO3 does not collect real names, and donor data is in a separate system that OTW says was not exposed.

OTW expects AO3 to stay down for at least two weeks and possibly up to four, perhaps returning earlier in a degraded or read-only state. Do now if you have an account: change the password anywhere you reused your AO3 password, and expect phishing that uses the incident as a lure; follow only otwstatus.org and AO3's official accounts. No attacker or entry point has been disclosed.