AO3 confirms a security incident and expects a two-to-four-week outage
AO3 confirms a security incident and expects at least two weeks of downtime, possibly four. It does not currently believe its user database was stolen but cannot rule that out. The operator says works and other AO3 data have not been deleted; donor data is held separately and was not exposed.
- Disclosed
- Oct 30, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- AO3 users, especially anyone reusing an AO3 password on another service
- AO3 · security incident · outage
- In the wild
- Unknown
- Security incident confirmed; user-database theft and the entry point remain unconfirmed.
What happened
If accessed, the user database could expose usernames, email addresses, IP addresses and password hashes. The operator warns that hashing does not fully protect weak or reused passwords. AO3 does not collect real names. The investigation has not established the entry point, affected-account count or database theft. L3 reflects a major platform’s confirmed security disruption, rather than a confirmed mass data leak.
Crime-scene timeline
Oct 29, 07:34 UTC
AO3 announces maintenance downtime
Oct 29, 17:45 UTC
Restoration estimate expands to around two to four weeks
Oct 30, 01:48 UTC
Operator publicly confirms a security incident
Database theft cannot be ruled out; reused-password changes are recommended as a precaution.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- AO3 official security statementPrimaryRead in full via the public official RSS; security disclosure is October 30, distinct from earlier maintenance notices.
- AO3 official public RSSPrimaryIncludes the complete statement and dated prior maintenance updates; no database theft or deletion is confirmed.