Technology1 min read

Archive of our own (AO3) hacked

By · Published by Everything Blog

In short

The platform anticipated remaining inaccessible for a minimum of two weeks, though it might briefly return in an unstable, read-only state during recovery operations. Operators confirmed that no stories or user data were erased during the intrusion. Investigators cannot entirely dismiss the chance that an exposed database containing usernames, emails, IP addresses, and hashed passwords was accessed. Because weak credentials can still be cracked, users should immediately change shared passwords on other websites.

Key points

  • Users should proactively update credentials on external websites if they reused their pla…: Users should proactively update credentials on external websites if they reused their platform password.
  • Donor information was kept completely safe due to its storage on an unexposed, separate s…: Donor information was kept completely safe due to its storage on an unexposed, separate system.
  • The platform may temporarily reappear in a degraded or read-only mode during ongoing reme…: The platform may temporarily reappear in a degraded or read-only mode during ongoing remediation efforts.

Sources checked by our analysis pipeline: 1

Update - Earlier today, we detected evidence of a security incident on AO3. We are still in the early stages of response to this security incident and determining its scope. AO3 will remain down while we continue investigating and addressing what has been found so far. However, we want to make some things clear:

First, no AO3 data has been deleted. All your works, bookmarks, kudos, etc., are safe.

Second, while we currently don't believe that the user database was stolen, we are also unable to rule it out. The AO3 database contains account information that may include your username, email address, IP address, and a hashed version of your password.

We use industry-standard techniques for storing passwords in a scrambled form that cannot easily be reversed. Even so, no hashing method can fully protect a weak or reused password from being cracked. As a precaution, we recommend that you change your passwords on any other sites where you use the same password as on AO3.

AO3 does not collect real names, so none could be exposed. Additionally, our donor…

Technology