AO3 expects two to four weeks offline after security incident

Archive of Our Own expects to remain offline for a minimum of two weeks and potentially up to four weeks while it investigates a security incident, its operator said. The operator said no works, bookmarks or other AO3 data had been deleted. It does not currently believe the user database was stolen but cannot rule that out. Account records may contain usernames, email addresses, IP addresses and hashed passwords. The operator recommends changing passwords on other sites where users reused their AO3 password. AO3 may return sooner with reduced functionality or read-only access, but recovery work could require further interruptions. Donor information is held in a separate system and was not exposed, the operator said.