Archive of Our Own (AO3), the nonprofit fan-fiction site run by the Organization for Transformative Works, went offline after detecting a security incident and expects to remain down for two to four weeks.
The site announced the outage hours after initially stating it was undergoing routine maintenance. "Earlier today, we detected evidence of a security incident on AO3," OTW said in a statement. "AO3 will remain down while we continue investigating and addressing what has been found so far."
OTW said it does not currently believe the user database was stolen but cannot rule it out. The AO3 database contains account information including usernames, email addresses, IP addresses, and hashed passwords. The organization recommended users change passwords on other sites if they reused the same password elsewhere.
AO3 uses industry-standard password hashing and runs on Ruby on Rails, making it unlikely the outage relates to last week's discovery of critical PHP flaws that affect about 70 percent of the internet.
The site's status page garnered millions of views across social media within two hours of the announcement. OTW expressed hope that it could bring AO3 back online in a degraded state sooner than the two to four week estimate.