> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:
First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments.
Oct 30, 2026 - 01:27 UTC
"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."
Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.
It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.
If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.
At this point it’s all public. Everything you do on the internet is or will be public.
I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.
I think we are approaching a future where no one will care. An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge. And nothing happened because everyone has embarrassing teenage past actions.
My memory of it is fuzzy but I feel like that exemplifies the point more. No one really faces any consequences for this stuff leaking unless it’s truly bad. After all these hacks everyone is going to have embarrassing details leaked but it probably won’t matter.
Tbh it's probably a good idea to have a bunch of different e-mail accounts, at least for all of the professional, personal and other personal things.
There's horror stories of automated systems suspending people's Google accounts and suddenly they can't access their photos and other important data.
Like if you use a password manager and all of the passwords are random, might as well go a step further and at least have separate e-mail accounts for groups of activities.
I'm certain many people signed up using established internet identities which can then be linked to real world identities through social engineering techniques.
I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.
>Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks.
That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.
> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
> Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:
First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.
Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.
AO3 does not collect real names, so none could be exposed. Additionally, our donor information is held in an entirely separate system and is never linked to AO3, so that data has also not been exposed.
We will update everyone as our investigation continues; we may be unable to respond to individual inquiries from users. Please keep an eye on our official outlets for updates. Our next update will be posted when we have further information available.
Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks. During that time, we may be able to bring the site back up in a degraded state, meaning that not all features will be available and/or the site may be read-only. If we are able to do that, please be aware that we might have to bring the site back down unexpectedly as part of our recovery efforts. We will keep you in the loop for any developments. Oct 30, 2026 - 01:27 UTC
"The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password."
Dear lord. Can you imagine the damage that could happen just by leaking everyone's username, email address, and all the stories they've written/kudos'ed/bookmarked? Like a miniature version of the Ashley Madison hack.
It's worth noting that often, the email can be correlated with other breaches to get your real name. People can do that relatively easily on osint websites. I wasn't terribly pleased when I found my teenage furaffinity account show up in an identity theft monitoring app. Other people have turned up in breaches of far more objectionable websites.
If your email provider offers email aliases, you should really get familiar with how to use them, and use a unique email alias per website.
At this point it’s all public. Everything you do on the internet is or will be public.
I was also in the furaffinity leak lol. Though ultimately everyone is in so many leaks it won’t even matter. Unless you have committed some kind of crime, having possibly embarrassing personal details leaked is the reality for everyone right now.
Also, character assassinations. Good luck telling fact from fiction!
I think we are approaching a future where no one will care. An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge. And nothing happened because everyone has embarrassing teenage past actions.
A good example would be the pedo felon sitting in the Whitehouse.
>An example would be the Canadian prime minister who had photos of him doing black face as a teenager emerge.
He was a teacher at the time, at West Point Grey Academy, not a teenager. [1]
I'm not saying people can't grow and make mistakes throughout their life, and become better people, but it was definitely not a teenage mistake.
[1]: https://www.cbc.ca/news/politics/canada-votes-2019-trudeau-b...
My memory of it is fuzzy but I feel like that exemplifies the point more. No one really faces any consequences for this stuff leaking unless it’s truly bad. After all these hacks everyone is going to have embarrassing details leaked but it probably won’t matter.
Best practice to use your non-primary email address for these kinds of site. Data breach is a matter of when, not if, it happens.
Tbh it's probably a good idea to have a bunch of different e-mail accounts, at least for all of the professional, personal and other personal things.
There's horror stories of automated systems suspending people's Google accounts and suddenly they can't access their photos and other important data.
Like if you use a password manager and all of the passwords are random, might as well go a step further and at least have separate e-mail accounts for groups of activities.
Did anyone sign up to that with their real name or email?
I'm certain many people signed up using established internet identities which can then be linked to real world identities through social engineering techniques.
Unless you had a unique email just for that service, you could just cross link it with another leak that contains your name.
Sure it’s possible to have perfect op sec but almost no one does in reality.
I am certain that many people will have signed up with an email address that contains their real name. If this leaks I’ve gotta imagine that someone with a particularly dark/evil sense of honour makes a tool where you enter an email address and are shown an AO3 presence.
If you put a phone number into Grindr's "forgot password" feature it tells you whether there's an account with that phone number or not.
I did. I couldn't care less if people know I write fanfiction. I talk about it IRL with people, completely without shame. firstnamelastname@gmail.com
>Our current expectation is that AO3 will be down for a minimum of two weeks; however, it could take up to four weeks.
That seems crazy to me. I've been part of orgs that have had stuff like this happen and they've been mostly back within 24 hours. I'm curious if they had no plan for this sort of thing and if they're unwilling to bring in professional companies that help analyze and cleanup these sorts of issues.
Y'all are doing the right thing. Thanks for all the care you put into AO3.
I don't think the person you responded to has anything to do with ao3. They quoted the content of the update on the linked status page.
Discussion from yesterday: https://news.ycombinator.com/item?id=50293546
> The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.
There's not much to be done about storing a username (though if you don't want the connection made it's already obviously smart not to have the same username on AO3 as on say, Facebook) and anonymous mail accounts make sense for fan work every bit as much as a PO Box does - but for passwords we can just do better and it makes sense to me as a worthwhile piece of engineering for AO3
WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
Replacing "something you know" with "something you have" is actually not an unalloyed good.
I don’t think they said that it was.
In that case how would you interpret the "we can just do better"?
> WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.
Yes, because all of those teenage fanfiction readers are going to have yubikeys.
It’s built into most smartphones now isn’t it?
The same tech does Passkeys too. I suspect in the future we will move to passkey/yubikey only auth and store as little user data as possible.
And there will be a word you can type into a backup yubikey to make it an identical clone. I.e. a password.
I guess this is just going to be the next few months/years, as HN right now is just breach after breach.
I'm sweating as a infrastructure guy for SaaS right now
wishing you and others luck
if something happens, it's probably not your fault?
Poor Troy Hunt is going to need to employ a team of minions (or at the very least agents).
I wonder how many breaches are going undetected/unreported
There are, no kidding, five or ten breaches on front page HN in the last three days. All php2shell, do you think?
[dupe] https://news.ycombinator.com/item?id=50293546