Archive of Our Own (AO3), one of the internet's largest fan fiction websites, could remain unavailable for up to four weeks after its operators discovered evidence of a security incident. The nonprofit Organization for Transformative Works (OTW) has confirmed that user-created stories and other archived material have not been deleted, but investigators cannot yet rule out the possibility that account information was accessed.
The shutdown began early Thursday, October 29, 2026, when AO3 unexpectedly went offline. What initially appeared to be a maintenance interruption lasting approximately 12 hours developed into a much larger problem, leaving millions of readers and writers facing an extended period without access to the archive.
In an official statement dated October 30, the nonprofit said it had detected evidence of a security incident and was working to determine its scope. The organization has not publicly identified how the incident occurred, who might be responsible or whether attackers successfully obtained user information.
AO3 Warns Restoration Could Take Four Weeks
AO3 first reported the outage at 3:13 a.m. Eastern Time on October 29. An update less than two hours later indicated that maintenance was underway and would require at least 12 hours, although the organization warned that additional time might be necessary.
By early afternoon, the outlook had changed significantly. The organization announced that restoring service would likely take approximately two weeks and could require as long as four weeks.
The lengthy estimate raised concern among users who depend on AO3 for reading, publishing and preserving fan-created fiction. Although the website has experienced temporary disruptions before, a shutdown potentially lasting a month would represent a substantial interruption to its normal operations.
The nonprofit said engineers are investigating the problem and working to restore access safely. It has not announced a firm reopening date, and the projected recovery period remains an estimate rather than a guaranteed schedule.
AO3 may become partially available before all repairs are finished. Under that arrangement, readers might regain access to some material while certain website features remain unavailable.
The organization has also discussed the possibility of operating the archive in read-only mode. Such access could allow users to browse existing stories without posting new works, editing content or using other interactive features.
Even if partial access becomes available, the website could experience additional shutdowns during recovery. The nonprofit has advised readers and writers to follow its official status page for developments rather than assuming that an initial reopening would mean all problems had been resolved.
Security Incident Raises Questions About Account Information
The most significant development is the organization's acknowledgment that the extended outage involves a potential security breach. Its October 30 statement confirmed that investigators had found evidence of a security incident affecting AO3.
The nonprofit emphasized that no archived content has been deleted. Stories, bookmarks, kudos and other saved information remain intact, according to the organization.
However, preserving content does not necessarily mean all account information is secure. The organization said it does not currently believe the user database was stolen, although investigators cannot completely rule out that possibility.
The database includes information associated with user accounts, potentially including usernames, email addresses, IP addresses and hashed passwords. The nonprofit has not confirmed that any of those details were accessed or copied.
Hashed passwords are stored in a scrambled form rather than ordinary readable text. This security measure makes it more difficult for unauthorized users to recover original passwords, but weak or reused passwords may still be vulnerable if the hashes are obtained.
As a precaution, AO3 advised users who share their AO3 password with other websites to change the passwords on those other services. The recommendation is preventive and does not establish that any passwords have been exposed.
The organization also explained that AO3 does not collect users' real names as part of its account information. Donation records are maintained separately from the archive's user database, and the nonprofit said those records were not exposed through this incident.
Investigators have not disclosed whether the incident involved unauthorized access, a software vulnerability or another form of attack. Until the investigation progresses, the full nature of the security problem remains uncertain.
Earlier Technical Problems Affected AO3 Features
The October 29 shutdown followed several technical disruptions affecting AO3 earlier in the month. On October 23, the organization reported problems with email notifications, search functions, reading history and the display of works and bookmarks.
Those issues also affected challenge matching and other background processes that help the website organize its large collection of stories. The organization subsequently reported that the problems had been resolved.
By October 24, AO3 said the backlog of delayed updates had been cleared and normal processing had resumed. The nonprofit also reassured users that no data had been lost during that earlier interruption.
There is currently no confirmed connection between those problems and the newly disclosed security incident. The timing has attracted attention, but the organization has not established that the events share a common cause.
Another OTW-operated project, Fanlore, temporarily went offline on October 21 because of concerns involving vulnerabilities in PHP, a widely used web programming language. Fanlore returned to service later that day after precautionary maintenance.
Engadget reported that the nonprofit had not linked AO3's outage to those PHP vulnerabilities. TechCrunch also noted that AO3 uses Ruby on Rails rather than the PHP framework involved in the earlier security concerns.
Those distinctions matter because unrelated technical incidents can occur across different websites operated by the same organization. The available evidence does not establish that the Fanlore maintenance or the earlier AO3 delays caused the current shutdown.
Millions of Fan Fiction Works Remain Unavailable
Founded in 2008, Archive of Our Own has developed into one of the world's largest collections of fan-created literature. It provides a free platform where writers publish stories inspired by television series, movies, books, video games and other cultural works.
The archive includes stories exploring alternative plotlines, relationships between fictional characters and imagined events outside established storylines. Readers can search by fandom, character, relationship, genre and other categories to find works matching their interests.
According to 404 Media, AO3 hosted more than 18.4 million works across approximately 82,900 fandoms as of September 2026. The scale of that collection helps explain why the shutdown has attracted widespread attention across online fan communities.
Unlike commercial publishing platforms, AO3 does not charge readers or writers for access. The website is supported by donations and operated under the nonprofit Organization for Transformative Works, which promotes and preserves fan-created cultural material.
The archive also depends heavily on volunteers for technical maintenance, support, moderation and other responsibilities. That organizational structure allows the nonprofit to maintain a large free resource but creates challenges when complex technical problems require sustained attention.
Engadget reported that AO3's engineering team consists of volunteers rather than paid employees. However, the organization has not stated that volunteer staffing is responsible for the length of the current recovery estimate.
For writers, the outage interrupts access to published stories, reader comments and statistics associated with their work. Readers have lost convenient access to bookmarked stories and ongoing series they may have followed for years.
Users who previously downloaded copies of stories may still be able to read them locally. Others may turn temporarily to alternative fan fiction websites, including Wattpad and FanFiction.net, while AO3 remains unavailable.
Organization Promises Updates During Investigation
The Organization for Transformative Works has asked users to monitor its official communication channels while engineers investigate the incident. Its status website continues to identify AO3 as experiencing a major outage.
The nonprofit has warned that it may not be able to respond individually to every inquiry because of the volume of interest surrounding the shutdown. Future announcements are expected to address the investigation and any progress toward restoring service.
For account holders, the immediate concern is whether personal information could have been compromised. The organization has not confirmed a database theft, but its password guidance reflects the uncertainty surrounding the incident.
The technical recovery also presents a separate challenge. Even if the investigation finds that user information was not stolen, engineers must ensure that the archive can resume operating without exposing it to further security problems.
AO3's operators have expressed hope that some services can return before the full two-to-four-week recovery period ends. They have not committed to a specific date for partial access or the restoration of normal operations.
For now, the archive remains unavailable while investigators examine the security incident. Its operators say the stored creative works remain intact, but the cause of the incident, any potential data exposure and the date of full restoration are still unresolved.