VULNpocalypse
MediumEcosystem changeOngoing

AO3 fan fiction archive offline after cyberattack, Times of India reports

Times of India reports AO3 has been offline since October 29 after a cyberattack, users who reused their AO3 password elsewhere should change it.

Published
Exploitation
Not confirmed, Times of India reports a cyberattack but no vulnerability or entry point is named

What happened

According to an AFP report carried by Times of India, the fan fiction library Archive of Our Own (AO3) has been offline for over a week after a cyberattack. The report says the site has shown a maintenance message since October 29.

Times of India says AO3 launched in 2008 and has over 11 million registered users and nearly 18 million works.

According to the report, the operator, the Organization for Transformative Works, said it did not believe its user database was stolen, but could not rule this out. Times of India says that database contains usernames, email addresses and passwords. The operator hopes to restore AO3 in a month, the report says.

These details are not confirmed:

  • The type of attack.
  • The entry point.
  • Whether any data was taken.
  • How passwords were stored.
  • Who was responsible.

The sources give no independent verification beyond the operator’s statement as reported.

Am I affected?

  • If you have an AO3 account, the operator says it cannot rule out theft of your username, email address and password, according to Times of India.
  • Whether any data was actually stolen is not confirmed.
  • If you only read works without an account, the source says nothing about any risk beyond the site being unavailable.

What to do now

These steps are precautions recommended by this advisory. They are not instructions from the operator.

  1. If your AO3 password is also used on any other account, change it on those accounts. Start with email and anything financial.
  2. Turn on two-factor authentication where those other services offer it.
  3. Be wary of emails that mention AO3, the outage or a password reset. The source says email addresses are among the data that could not be ruled out as stolen.
  4. When AO3 returns, set a new, unique password there. Follow any reset guidance the operator publishes.

Sources