Archive of Our Own, the huge fan-fiction site known as AO3, is offline and may stay that way for weeks. The site went down on Thursday, October 29, during what was meant to be routine overnight maintenance, and its operator, the nonprofit Organization for Transformative Works (OTW), then said it had detected evidence of a security incident, according to TechCrunch and Engadget.
What OTW has said. The organization said it is in the early stages of responding and is still working out the scope of the incident. It estimated that restoring service will take about two weeks, but warned that it could take up to four. OTW said it hopes to bring the site back in a degraded state sooner, and that it may need to take the site offline again briefly during recovery.
What about your data? OTW says no AO3 data has been deleted, so works, bookmarks and kudos are safe. On the user database, OTW says it does not currently believe the data was stolen, but it cannot rule that out. That database holds account details such as usernames, email addresses, IP addresses and hashed passwords. A hashed password is a scrambled version that is not the password itself. TechCrunch notes that AO3 uses an industry-standard hashing method, and AO3 does not collect real names, so none could have been exposed.
What users should do. OTW recommends changing your password on any other site where you used the same one as on AO3. That is sensible advice even if the database was not taken, because reusing passwords lets a leak on one site unlock accounts on others. A password manager and a unique password for each site are the standard fix.
Is it linked to the recent PHP flaws? Some people suspected a connection to the recent wave of PHP vulnerabilities in the news. TechCrunch notes that AO3 runs on Ruby on Rails, not PHP, so the outage is unlikely to be related. OTW has not said how the incident happened, and the reports reviewed did not identify who is responsible.
Why it matters. AO3 is one of the largest archives of fan-made work on the internet, and OTW is a nonprofit that relies on volunteers and donations. A long outage hits readers and writers, and it also strains a small organization that now has to investigate and recover at the same time. TechCrunch reports that the site’s status page posts drew millions of views within two hours, with a lot of worried commentary on social media. OTW and AO3 had not responded to the outlet’s requests for comment when it published.
What to watch. The OTW status page is the authoritative place for updates. Look for confirmation of whether any user data was accessed, a clearer cause, and the date the site returns, at first in a limited form.
Sources: TechCrunch, Engadget and statements from the Organization for Transformative Works as reported by them.
Data center servers (representative image), Wikimedia Commons, CC BY-SA 3.0
