> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:

First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.

Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.

We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.

AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.

We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.

Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments. Oct 30, 2026 - 01:27 UTC

▲

rahidz 5 hours ago | parent | next [-]

"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."

Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.

▲

ashleyn 3 hours ago | parent | next [-]

It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.

If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.

▲

Gigachad an hour ago | parent [-]

At this point it’s all public. Everything you do on the internet is or will be public.

I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.

▲

whoanoway an hour ago | parent [-]

Also, character assassinations. Good luck telling fact from fiction!

	▲	Gigachad an hour ago \| parent [-]
		I think we are approaching a future where no one will care. An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge. And nothing happened because everyone has embarrassing teenage past actions.

▲

echoangle 5 hours ago | parent | prev [-]

Did anyone sign up to that with their real name or email?

	▲	lunar_rover 4 hours ago \| parent \| next [-]
		I'm certain many people signed up using established internet identities which can then be linked to real world identities through social engineering techniques.
	▲	Gigachad an hour ago \| parent \| prev \| next [-]
		Unless you had a unique email just for that service, you could just cross link it with another leak that contains your name. Sure it’s possible to have perfect op sec but almost no one does in reality.
	▲	UqWBcuFx6NV4r 3 hours ago \| parent \| prev \| next [-]
		I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.
	▲	KPGv2 an hour ago \| parent \| prev [-]
		I did. I couldn't care less if people know I write fanfiction. I talk about it IRL with people, completely without shame. firstnamelastname@gmail.com

▲

culi 5 hours ago | parent | prev [-]

Y'all are doing the right thing. Thanks for all the care you put into AO3.

▲

Zambyte 5 hours ago | parent [-]

I don't think the person you responded to has anything to do with ao3. They quoted the content of the update on the linked status page.

▲

NooneAtAll5 4 hours ago | parent [-]

[flagged]

▲

UqWBcuFx6NV4r 3 hours ago | parent [-]

“They” is a very, very widely accepted gender-neutral fallback pronoun, acceptably used even in cases where the subject may not “identify as a they/them” or whatever phraseology has got you perturbed. Software developers should be especially aware of this as this makes writing user-facing content much easier. Any disagreement with this is almost certainly some sort of culture war issue, at best wrapped with a thin guide of “caring about proper English”. But thanks anyway.

	▲	frenchtoast8 an hour ago \| parent \| next [-]
		My favorite fun fact about this is that a Stack Exchange community moderator was removed for referring to others as “they/them”
	▲	KPGv2 an hour ago \| parent \| prev [-]
		Also it's been used for centuries by writers who are considered at the top of the craft. It's not a neologism. It dates back to the 14th century. Authors who use "they" as a gender neutral singular pronoun include: Shakespeare, Chaucer, Austen, Dickens, etc. In fact, it was 18th century schoolteachers who invented the "rule" that it wasn't acceptable usage. These same losers also invented the "rules" that you can't end a sentence with a preposition, you can't split an infinitive, and you can't start a sentence with a conjunction. These are all fake rules that were just poorly obfuscated attempts to make English follow Latin grammar (bc Latin was allegedly a "perfect" language)