Source: AFP

Archive of Our Own, one of the world’s most popular fan fiction libraries, has been dark for more than a week after a cyberattack forced it offline on 29 October 2026. Anyone trying to reach the site, known to its users as AO3, is met with a maintenance message. The nonprofit Organization for Transformative Works, which runs the platform, says it hopes to have the site back up within a month.

What we know so far

AO3 hosts nearly 18 million works and has more than 11 million registered users. The organisation says it does not believe the user database, which holds usernames, email addresses and encrypted passwords, was stolen, but it cannot rule it out, and it insists there is no data loss. Analysts note that a recovery timeline measured in weeks points to a serious incident, whether from limited resources, a need for a full software upgrade or a painstaking rebuild. The platform, which won a Hugo Award in 2019, runs on donated infrastructure and a volunteer team, which makes a slow, careful restoration unsurprising.

The lesson for every organisation

The uncomfortable takeaway is not about fan fiction. It is that a single successful attack can silence an entire service for weeks, and that having backups is not the same as having a recovery. What separates a short outage from a multi week one is usually preparation: backups that are actually tested by restoring from them, a rehearsed incident response plan, a hardened attack surface, and honest communication with users while systems are rebuilt. If credentials were exposed, forced password resets and session revocation need to be ready to go, not improvised.

Ask yourself how long your organisation could stay offline before the damage became unacceptable. If you do not have a confident answer, contact the team at Excello Digital for incident response planning, resilience reviews and security architecture that keeps your business running when an attack lands.