Since 29 October 2026, the Archive of Our Own, known to millions of readers as AO3, has been unreachable. Anyone trying to open the site meets a maintenance message, and the blackout has now lasted more than a week. With over 11 million registered users and nearly 18 million works stored on the platform, according to Agence France-Presse, reporting for France 24 on 7 November 2026, this is one of the largest cultural websites in the world going dark overnight. The cause, in the words of the organisation that runs the site, is a cyberattack, described in its own updates as a “security incident”. The operator, the United States nonprofit Organization for Transformative Works, says it does not believe the user database was stolen, but it cannot rule it out. That database holds usernames, email addresses and encrypted passwords, the same dispatch reports. Restoration could take up to a month. Readers in France and in the European Union are directly concerned: their accounts, their email addresses and sometimes years of reading history and creative work sit on those servers, and European data protection law follows their data even when the operator is American and the service is free. This article explains what is established today, the five steps to take immediately to protect your accounts, and the rights French and European law gives you: what the platform must do within 72 hours, how to obtain, correct or delete your data, how to complain to the data protection authority, and when the criminal courts and compensation come into play.
I. AO3 is down after a cyberattack: what users know and what to do right now
A. “AO3 down” and “AO3 status”: what the press and the operator report
The facts, as reported by the national and international press, are consistent. The New York Times, on 30 October 2026, reported that the fan fiction site AO3 had been hacked and its 18 million stories knocked offline. Wired describes readers writing “survival guides” to cope with what some call the AO3 apocalypse, while the site warns the outage could last for weeks. France 24, on 7 November 2026, citing Agence France-Presse, confirms the site has been dark since 29 October after a cyberattack forced it offline, leaving millions of readers without access to their favourite stories.
To understand the scale, a few figures help. Launched in 2008, AO3 has become the main home of fan fiction, the amateur stories written with characters and worlds borrowed from books, films or television series, shared online for free. The genre has become a launchpad for publishing, from E. L. James’s “Fifty Shades of Grey”, which began as “Twilight” fan fiction, to Ali Hazelwood’s bestseller “The Love Hypothesis”, born from the “Star Wars” universe. The platform won a Hugo Award for Best Related Work in 2019, one of the most prestigious distinctions in science fiction. Harvard Law School professor Rebecca Tushnet, who helped found the Organization for Transformative Works (organisation d’oeuvre transformative, the nonprofit that runs the site), is quoted in the France 24 dispatch explaining that the project was built so fans could engage in non-commercial creativity without advertising, censorship to please advertisers, or sale of their data.
On the substance of the incident, the operator’s public statements, relayed by the press, contain four points. First, the cause is a cyberattack against the platform’s systems, and the team speaks of a “security incident”. Second, the operator states that it does not believe the user database, which holds usernames (noms d’utilisateur), email addresses (adresses electroniques) and encrypted passwords (mots de passe chiffres), was stolen, but it cannot exclude that possibility. Third, it states there is no data loss (aucune perte de donnees) and that it hopes to restore the site as soon as possible, within a horizon of about a month according to the nonprofit. Fourth, independent specialists quoted by the press note that such a timeline reflects the seriousness of the attack: limited resources, a full software upgrade described as an enormous task, and backups to verify before bringing everything back. For the reader in France or elsewhere in the Union, the practical consequence is simple: an account holding an email address and a password, sometimes reused on other services, is sitting on systems that attackers have reached, and nobody can yet certify that the account database stayed out of their hands.
Why does French and European law apply to an American nonprofit offering a free service? Because the General Data Protection Regulation protects people who are in the Union when services are offered to them, whether or not payment is required. Article 3 of the Regulation, on territorial scope (champ d’application territorial), provides: “Le présent règlement s’applique au traitement des données à caractère personnel relatives à des personnes concernées qui se trouvent sur le territoire de l’Union par un responsable du traitement ou un sous-traitant qui n’est pas établi dans l’Union, lorsque les activités de traitement sont liées: a) à l’offre de biens ou de services à ces personnes concernées dans l’Union, qu’un paiement soit exigé ou non desdites personnes” (This Regulation applies to the processing of the personal data of people in the Union by a controller or processor not established in the Union, where the processing relates to offering them goods or services, whether or not payment is required (Regulation (EU) 2016/679, EUR-Lex). A French reader with an AO3 account is therefore a data subject (personne concernee) whose email address and username are personal data (donnees a caractere personnel), defined by the Regulation as “«données à caractère personnel», toute information se rapportant à une personne physique identifiée ou identifiable (ci-après dénommée «personne concernée»); est réputée être une «personne physique identifiable» une personne physique qui peut être identifiée, directement ou indirectement, notamment par référence à un identifiant, tel qu’un nom, un numéro d’identification, des données de localisation, un identifiant en ligne, ou à un ou plusieurs éléments spécifiques propres à son identité physique, physiologique, génétique, psychique, économique, culturelle ou sociale” (personal data means any information relating to an identified or identifiable natural person, who can be identified directly or indirectly by an identifier such as a name, an identification number, location data or an online identifier”. The operator, which decides why and how accounts are managed, is the controller (responsable du traitement). Everything that follows flows from that classification.
B. Five immediate steps to protect your accounts and your evidence
The operator has not confirmed any theft of personal data, and encrypted passwords are not readable as such. That is reassuring but not sufficient to do nothing, because “encrypted” does not mean “unbreakable”: weakly chosen passwords can be recovered from their encrypted form by automated guessing, and a valid email address alone is enough to receive targeted fraud. The following steps cost nothing and remain useful whatever the final findings of the investigation turn out to be.
First, isolate the password. If the password used on AO3 is also used on an email inbox, a bank, a social network or a work tool, change those other passwords first, starting with the email inbox, because whoever controls an inbox can reset almost everything else. Give each sensitive account its own long password, ideally generated and stored by a password manager (gestionnaire de mots de passe). When AO3 returns, replace the AO3 password with a new unique one as well, and activate two-factor authentication (authentification a deux facteurs) if the platform offers it. This single measure neutralises the most common consequence of account database leaks, the automated replay of stolen email and password pairs on hundreds of other sites, a technique known as credential stuffing (bourrage d’identifiants).
Second, treat every message about the incident with suspicion. After every widely publicised breach, forged emails and private messages appear, imitating the operator and inviting users to “verify their account”, “recover their library” or “download a backup tool”. These are phishing attempts (tentatives d’hameconnage) designed to steal the new password or install malicious software. Do not click links in unsolicited messages, even if the logo and tone look right. To check the state of the platform, type the official address yourself or follow the operator’s verified status channels, and compare any message received with those official publications before acting on it. No serious operator asks users for their password by email.
Third, watch your inbox and your accounts for secondary effects. A leaked email address exposes its owner to spam, scams and targeted manipulation, sometimes months later. Be particularly careful with messages that reference fan fiction, your username or your reading to look credible, with fake invoices, alleged copyright warnings (avertissements pour violation du droit d’auteur) demanding payment, and with urgent requests for money or gift cards. If fraudulent use of your identity causes a concrete loss, keep every trace: headers of the messages, screenshots, dates, sums. These elements will support a complaint (plainte) and a claim for compensation (demande d’indemnisation), examined in the second part of this article.
Fourth, exercise your data rights early rather than waiting for the full restoration. Even while the site is down, you can write to the operator to ask what personal data it holds about you and to record your requests, as explained below: access (droit d’acces), erasure (droit a l’effacement) or objection (droit d’opposition). A request sent now creates a dated record, which matters if deadlines later become disputed. Keep a copy of every request and every reply. If you decide to leave the platform, an erasure request covering the account, the email address and associated content protects you against future leaks from the same database.
Fifth, preserve evidence of what you could lose. Readers with long bookmark lists, subscribers following ongoing stories, and authors with unpublished drafts (brouillons) should gather what they still have outside the platform: email notifications of comments or new chapters, downloaded copies, correspondence with co-authors. The operator states there is no data loss, and specialists recall that well-run sites keep backup copies of their databases, so collections should normally reappear. But if a work disappears or an account becomes inaccessible, a file of dated screenshots and saved messages will make any later request for restoration or compensation far easier. These reflexes mirror those recommended after other large breaches affecting French users, such as the cyberattack against the French training body Afpa, which exposed the data of about 1.7 million people and gave rise to a detailed guide on what to do, complain and claim compensation.
II. Your rights under French and European law after a data breach
A. What the platform must do: warn within 72 hours, inform users, answer requests
European law places the first obligations on the operator, not on the victims. When personal data are compromised, the controller must warn the competent authority quickly, and warn the affected people directly whenever the risk to them is high. These duties apply to the AO3 incident exactly as they would to a French company, because of the territorial scope recalled above.
The central duty is the notification to the supervisory authority (notification a l’autorite de controle). Article 33 of the General Data Protection Regulation provides: “En cas de violation de données à caractère personnel, le responsable du traitement en notifie la violation en question à l’autorité de contrôle compétente conformément à l’article 55, dans les meilleurs délais et, si possible, 72 heures au plus tard après en avoir pris connaissance, à moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libertés des personnes physiques. Lorsque la notification à l’autorité de contrôle n’a pas lieu dans les 72 heures, elle est accompagnée des motifs du retard.” (In the case of a personal data breach, the controller notifies the competent supervisory authority without undue delay and, where possible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to create a risk for people’s rights and freedoms; late notification must explain the delay (Regulation (EU) 2016/679, Article 33, EUR-Lex). A personal data breach (violation de donnees a caractere personnel) covers any incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A cyberattack that takes eleven million accounts offline and may have exposed the account database plainly falls within that definition, so the 72-hour clock runs from the moment the operator became aware of the attack, not from the end of its investigation. The notification must describe the nature of the breach, the categories and approximate number of people concerned, the likely consequences, and the measures taken or planned. If the operator uses a service provider hosting the data, that processor (sous-traitant) must itself warn the operator “dans les meilleurs délais après en avoir pris connaissance” (without undue delay after becoming aware of a personal data breach”.
The second duty is owed directly to users whenever the danger is serious. Article 34 of the Regulation provides: “Lorsqu’une violation de données à caractère personnel est susceptible d’engendrer un risque élevé pour les droits et libertés d’une personne physique, le responsable du traitement communique la violation de données à caractère personnel à la personne concernée dans les meilleurs délais.” (When a personal data breach is likely to create a high risk for a person’s rights and freedoms, the controller communicates the breach to that person without undue delay (Regulation (EU) 2016/679, Article 34, EUR-Lex). That communication must be written in clear and plain language (en langage clair et simple) and explain the nature of the breach, a contact point, the likely consequences and the measures taken. The operator is dispensed from this individual warning in three situations only: the affected data were protected by measures such as encryption that make them unintelligible to unauthorised persons; subsequent measures have removed the high risk; or individual communication would involve disproportionate effort, in which case a public communication reaching users in an equally effective manner is required instead. Applied to AO3, the encryption of passwords is a serious argument, but it does not settle the question by itself: email addresses and usernames are not encrypted, and weak passwords remain guessable, so users are entitled to expect a transparent explanation of what was exposed, what remains uncertain, and what the operator advises them to do.
Alongside these emergency duties, users hold permanent rights over their data, enforceable against the operator at any time, including now. The right to information (droit a l’information) is framed by French law: “Le droit à l’information s’exerce dans les conditions prévues aux articles 12 à 14 du règlement (UE) 2016/679 du 27 avril 2016.” (The right to information is exercised under the conditions laid down in Articles 12 to 14 of Regulation (EU) 2016/679 of 27 April 2016.) (Article 48 of Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, Legifrance). The right of access (droit d’acces) allows anyone to obtain confirmation of whether data about them are processed and to receive a copy: “Le droit d’accès de la personne concernée s’exerce dans les conditions prévues à l’article 15 du règlement (UE) 2016/679 du 27 avril 2016.” (The data subject’s right of access is exercised under the conditions laid down in Article 15 of Regulation (EU) 2016/679 of 27 April 2016.) (Article 49 of Law No. 78-17, Legifrance). The European text behind that reference states: “La personne concernée a le droit d’obtenir du responsable du traitement la confirmation que des données à caractère personnel la concernant sont ou ne sont pas traitées et, lorsqu’elles le sont, l’accès auxdites données à caractère personnel ainsi que les informations suivantes” (The data subject has the right to obtain confirmation as to whether data about them are being processed and, where that is the case, access to those data (Regulation (EU) 2016/679, Article 15, EUR-Lex). Concretely, a user can ask AO3 which data it stores about the account: registration email, username, IP addresses, reading history, payment data for donations, and correspondence.
Correction and deletion follow the same path. French law states: “Le droit de rectification s’exerce dans les conditions prévues à l’article 16 du règlement (UE) 2016/679 du 27 avril 2016.” (The right to rectification is exercised under the conditions laid down in Article 16 of Regulation (EU) 2016/679 of 27 April 2016.) (Article 50 of Law No. 78-17, Legifrance). And: “I.-Le droit à l’effacement s’exerce dans les conditions prévues à l’article 17 du règlement (UE) 2016/679 du 27 avril 2016.” (I. The right to erasure is exercised under the conditions laid down in Article 17 of Regulation (EU) 2016/679 of 27 April 2016.) (Article 51 of Law No. 78-17, Legifrance). The European provision specifies: “La personne concernée a le droit d’obtenir du responsable du traitement l’effacement, dans les meilleurs délais, de données à caractère personnel la concernant et le responsable du traitement a l’obligation d’effacer ces données à caractère personnel dans les meilleurs délais, lorsque l’un des motifs suivants s’applique” (The data subject has the right to obtain erasure of their personal data without undue delay, and the controller must erase them without undue delay where one of the listed grounds applies”, including where the data “have been unlawfully processed (Regulation (EU) 2016/679, Article 17, EUR-Lex). Data collected during an unlawful intrusion qualify. Finally, users may object to processing: “Le droit d’opposition s’exerce dans les conditions prévues à l’article 21 du règlement (UE) 2016/679 du 27 avril 2016.” (The right to object is exercised under the conditions laid down in Article 21 of Regulation (EU) 2016/679 of 27 April 2016.) (Article 56 of Law No. 78-17, Legifrance).
When the operator does not answer, answers incompletely, or refuses without reason, the next step is the supervisory authority. European law gives every person this recourse: “Sans préjudice de tout autre recours administratif ou juridictionnel, toute personne concernée a le droit d’introduire une réclamation auprès d’une autorité de contrôle, en particulier dans l’État membre dans lequel se trouve sa résidence habituelle, son lieu de travail ou le lieu où la violation aurait été commise, si elle considère que le traitement de données à caractère personnel la concernant constitue une violation du présent règlement.” (Without prejudice to any other administrative or judicial remedy, every data subject may complain to a supervisory authority, particularly in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of their data infringes the Regulation (Regulation (EU) 2016/679, Article 77, EUR-Lex). For a person living in France, that authority is the CNIL (Commission nationale de l’informatique et des libertes), which receives complaints (plaintes aupres de la CNIL) online. The authority must inform the complainant of the progress and outcome of the complaint. A complaint is free, does not require a lawyer, and can run alongside court proceedings: choosing one route never closes the other.
B. Criminal prosecution and compensation: what French courts say
Attacking a platform’s computer systems is a criminal offence (infraction penale) in France, punished severely and independently of whether personal data were actually stolen. Three provisions of the Criminal Code (code penal) cover the conduct seen in the AO3 incident. First: “Le fait d’accéder ou de se maintenir, frauduleusement, dans tout ou partie d’un système de traitement automatisé de données est puni de trois ans d’emprisonnement et de 100 000 € d’amende. Lorsqu’il en est résulté soit la suppression ou la modification de données contenues dans le système, soit une altération du fonctionnement de ce système, la peine est de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Fraudulently accessing or remaining in all or part of an automated data processing system is punished by three years’ imprisonment and a 100,000 euro fine. Where this has resulted in the deletion or modification of data contained in the system, or an alteration of the functioning of that system, the penalty is five years’ imprisonment and a 150,000 euro fine.) (Article 323-1 of the Criminal Code, Legifrance). Second, disrupting the operation of such a system: “Le fait d’entraver ou de fausser le fonctionnement d’un système de traitement automatisé de données est puni de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Obstructing or distorting the functioning of an automated data processing system is punished by five years’ imprisonment and a 150,000 euro fine.) (Article 323-2 of the Criminal Code, Legifrance). A site forced offline for weeks by an attack matches this definition. Third, handling the data themselves: “Le fait d’introduire frauduleusement des données dans un système de traitement automatisé, d’extraire, de détenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les données qu’il contient est puni de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Fraudulently introducing data into an automated processing system, or fraudulently extracting, holding, reproducing, transmitting, deleting or modifying the data it contains, is punished by five years’ imprisonment and a 150,000 euro fine.) (Article 323-3 of the Criminal Code, Legifrance). Copying a user database or holding it for ransom would fall under this last text.
The Cour de cassation, the highest French court for criminal matters (chambre criminelle de la Cour de cassation), interprets these provisions broadly. In a judgment of 2 September 2025 (appeal No. 24-83.605, rejection), it upheld the conviction of a company network administrator who had secretly read his manager’s archived emails and even installed a hidden automatic forwarding of those messages to his own address, sentencing him to three months’ imprisonment with suspension (emprisonnement avec sursis). The Court held: “se rend coupable de l’infraction prévue par l’article 323-1 du code pénal celui qui se maintient dans un système de traitement automatisé de données en prenant connaissance du contenu des messages échangés au sein du réseau, à des fins étrangères à sa mission et à l’insu des titulaires des messages, même si, administrateur du réseau, il bénéficie, de par ses fonctions, d’un droit général d’accès à la messagerie.” (A person is guilty of the offence laid down in Article 323-1 of the Criminal Code where he remains in an automated data processing system by reading the content of messages exchanged within the network, for purposes unrelated to his duties and without the knowledge of the owners of those messages, even if, as network administrator, his functions give him a general right of access to the messaging system.) (Court of Cassation, Criminal Chamber, 2 September 2025, No. 24-83.605). The lesson for victims of a hack is symmetrical: authorisation to access a system never authorises its misuse, and unauthorised access remains punishable even when the intruder used technically valid credentials.
Victims can trigger prosecution by filing a criminal complaint (porter plainte), for example for fraudulent access or for fraudulent extraction of data, and can join the proceedings as a civil party (constitution de partie civile) to seek damages in the same trial. The complaint can be filed at any police station or gendarmerie brigade, or by letter to the public prosecutor (procureur de la Republique) of the place of residence. Keeping the evidence listed in the first part of this article, account records, messages received, proof of any financial loss, gives the complaint its weight.
Compensation can also be sought in civil proceedings, on two complementary bases. Under ordinary French law: “Tout fait quelconque de l’homme, qui cause à autrui un dommage, oblige celui par la faute duquel il est arrivé à le réparer.” (Article 1240 of the Civil Code, Legifrance). A platform that failed to secure its systems commits a fault engaging its liability where that failure caused the leak. Under European law, the route is even more direct: “Toute personne ayant subi un dommage matériel ou moral du fait d’une violation du présent règlement a le droit d’obtenir du responsable du traitement ou du sous-traitant réparation du préjudice subi.” (Regulation (EU) 2016/679, Article 82, EUR-Lex). The first text states the French principle that any faulty act causing damage must be repaired; the second gives anyone who has suffered material or non-material damage from a GDPR infringement a direct right to compensation from the controller or processor. Non-material damage covers anxiety, loss of control over personal data and time spent remedying the consequences, without any need for a financial loss, but the damage must be demonstrated and connected to the infringement.
For French users, the applicable time limit for bringing the civil claim is five years: “Les actions personnelles ou mobilières se prescrivent par cinq ans à compter du jour où le titulaire d’un droit a connu ou aurait dû connaître les faits lui permettant de l’exercer.” (Personal or movable actions are time-barred after five years from the day on which the holder of a right knew or ought to have known the facts enabling him to exercise it.) (Article 2224 of the Civil Code, Legifrance). In a breach discovered in stages, that starting point will often be the day the user learned, or should have learned, that their data were compromised, which is one more reason to keep every notification and screenshot.
Conclusion
No official source has established, as this article is written, that intruders stole the AO3 user database, and none has established that user data are intact either; only the operator’s investigation and the restoration of the service will settle the question. What is certain is that eleven million accounts, including those of French and European readers, sat for weeks on attacked systems, and that the law does not leave those readers powerless. Change exposed passwords starting with the email inbox, distrust any message invoking the incident, monitor accounts for fraud, exercise access and erasure rights in writing, and preserve evidence of accounts and losses. On the legal side, the operator owes notification within 72 hours and a plain-language warning whenever the risk is high, users hold rights of access, rectification, erasure and objection enforceable today, the CNIL can be seized by complaint, the criminal law punishes the intrusion with up to five years’ imprisonment, and compensation for material or non-material damage can be claimed within five years of discovering the facts. The outage will end; the rights remain, and exercising them promptly is the surest way to turn a period of forced waiting into a protected position.