On October 29, bedrock fanfiction website Archive of Our Own (AO3) was taken down for maintenance that was initially predicted to last 12 hours. Later that day, the estimated downtime was upped to two to four weeks. On October 30, the site's volunteer leadership shared a more substantial update about the security intrusion behind the takedown.
At the time of writing, the team is "still in the early stages" of determining the scope of the intrusion. AO3 has assured readers and authors that the archive itself and associated data (bookmarks, kudos, etc.) remain intact. Donor information is stored on a completely separate system, meaning that data is safe.
The AO3 team is "unable to rule out" that its user database was compromised in the hack. AO3 user accounts include emails, usernames, IP addresses, and hashed (encrypted) passwords. In an abundance of caution, the team advises users to update passwords they may have reused from AO3—but that's just good practice in general, gamers.
Over the coming weeks, the team anticipates that AO3 will be brought back in a "degraded" state, meaning incomplete or read-only access, as well as further intermittent downtime. As for why this happened, that remains unclear.
AO3 is a very widely-used service, and the sheer numbers game of weak passwords combined with emails in its user database could make it valuable on the black market. I also don't think you can rule out a more ideological motivation for such an attack, given fanfiction's long association with women and the queer community.
Either way: It's just poor form. Very meanspirited. An invitation to several lifetimes' worth of bad karma. I see AO3 on a continuum with The Internet Archive and Wikipedia as a holdout of a more utopian internet, a website that exists, uncorrupted by money, because people like it and it's good. Why would you mess that up for everybody?
