{"id":2163046,"date":"2026-11-07T05:40:20","date_gmt":"2026-11-07T04:40:20","guid":{"rendered":"https:\/\/kohenavocats.fr\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/"},"modified":"2026-11-07T05:40:20","modified_gmt":"2026-11-07T04:40:20","slug":"ao3-down-hack-protect-account-data-rights-france-eu","status":"publish","type":"post","link":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/","title":{"rendered":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU"},"content":{"rendered":"

Since 29 October 2026, the Archive of Our Own, known to millions of readers as AO3, has been unreachable. Anyone trying to open the site meets a maintenance message, and the blackout has now lasted more than a week. With over 11 million registered users and nearly 18 million works stored on the platform, according to Agence France-Presse, reporting for France 24 on 7 November 2026<\/a>, this is one of the largest cultural websites in the world going dark overnight. The cause, in the words of the organisation that runs the site, is a cyberattack, described in its own updates as a “security incident”. The operator, the United States nonprofit Organization for Transformative Works, says it does not believe the user database was stolen, but it cannot rule it out. That database holds usernames, email addresses and encrypted passwords, the same dispatch reports. Restoration could take up to a month. Readers in France and in the European Union are directly concerned: their accounts, their email addresses and sometimes years of reading history and creative work sit on those servers, and European data protection law follows their data even when the operator is American and the service is free. This article explains what is established today, the five steps to take immediately to protect your accounts, and the rights French and European law gives you: what the platform must do within 72 hours, how to obtain, correct or delete your data, how to complain to the data protection authority, and when the criminal courts and compensation come into play.<\/p>\n

I. AO3 is down after a cyberattack: what users know and what to do right now<\/h2>\n

A. “AO3 down” and “AO3 status”: what the press and the operator report<\/h3>\n

The facts, as reported by the national and international press, are consistent. The New York Times, on 30 October 2026<\/a>, reported that the fan fiction site AO3 had been hacked and its 18 million stories knocked offline. Wired<\/a> describes readers writing “survival guides” to cope with what some call the AO3 apocalypse, while the site warns the outage could last for weeks. France 24, on 7 November 2026<\/a>, citing Agence France-Presse, confirms the site has been dark since 29 October after a cyberattack forced it offline, leaving millions of readers without access to their favourite stories.<\/p>\n

To understand the scale, a few figures help. Launched in 2008, AO3 has become the main home of fan fiction, the amateur stories written with characters and worlds borrowed from books, films or television series, shared online for free. The genre has become a launchpad for publishing, from E. L. James’s “Fifty Shades of Grey”, which began as “Twilight” fan fiction, to Ali Hazelwood’s bestseller “The Love Hypothesis”, born from the “Star Wars” universe. The platform won a Hugo Award for Best Related Work in 2019, one of the most prestigious distinctions in science fiction. Harvard Law School professor Rebecca Tushnet, who helped found the Organization for Transformative Works (organisation d’oeuvre transformative, the nonprofit that runs the site), is quoted in the France 24 dispatch explaining that the project was built so fans could engage in non-commercial creativity without advertising, censorship to please advertisers, or sale of their data.<\/p>\n

On the substance of the incident, the operator’s public statements, relayed by the press, contain four points. First, the cause is a cyberattack against the platform’s systems, and the team speaks of a “security incident”. Second, the operator states that it does not believe the user database, which holds usernames (noms d’utilisateur), email addresses (adresses electroniques) and encrypted passwords (mots de passe chiffres), was stolen, but it cannot exclude that possibility. Third, it states there is no data loss (aucune perte de donnees) and that it hopes to restore the site as soon as possible, within a horizon of about a month according to the nonprofit. Fourth, independent specialists quoted by the press note that such a timeline reflects the seriousness of the attack: limited resources, a full software upgrade described as an enormous task, and backups to verify before bringing everything back. For the reader in France or elsewhere in the Union, the practical consequence is simple: an account holding an email address and a password, sometimes reused on other services, is sitting on systems that attackers have reached, and nobody can yet certify that the account database stayed out of their hands.<\/p>\n

Why does French and European law apply to an American nonprofit offering a free service? Because the General Data Protection Regulation protects people who are in the Union when services are offered to them, whether or not payment is required. Article 3 of the Regulation, on territorial scope (champ d’application territorial), provides: “Le pr\u00e9sent r\u00e8glement s’applique au traitement des donn\u00e9es \u00e0 caract\u00e8re personnel relatives \u00e0 des personnes concern\u00e9es qui se trouvent sur le territoire de l’Union par un responsable du traitement ou un sous-traitant qui n’est pas \u00e9tabli dans l’Union, lorsque les activit\u00e9s de traitement sont li\u00e9es: a) \u00e0 l’offre de biens ou de services \u00e0 ces personnes concern\u00e9es dans l’Union, qu’un paiement soit exig\u00e9 ou non desdites personnes” (This Regulation applies to the processing of the personal data of people in the Union by a controller or processor not established in the Union, where the processing relates to offering them goods or services, whether or not payment is required (Regulation (EU) 2016\/679, EUR-Lex<\/a>). A French reader with an AO3 account is therefore a data subject (personne concernee) whose email address and username are personal data (donnees a caractere personnel), defined by the Regulation as “\u00abdonn\u00e9es \u00e0 caract\u00e8re personnel\u00bb, toute information se rapportant \u00e0 une personne physique identifi\u00e9e ou identifiable (ci-apr\u00e8s d\u00e9nomm\u00e9e \u00abpersonne concern\u00e9e\u00bb); est r\u00e9put\u00e9e \u00eatre une \u00abpersonne physique identifiable\u00bb une personne physique qui peut \u00eatre identifi\u00e9e, directement ou indirectement, notamment par r\u00e9f\u00e9rence \u00e0 un identifiant, tel qu’un nom, un num\u00e9ro d’identification, des donn\u00e9es de localisation, un identifiant en ligne, ou \u00e0 un ou plusieurs \u00e9l\u00e9ments sp\u00e9cifiques propres \u00e0 son identit\u00e9 physique, physiologique, g\u00e9n\u00e9tique, psychique, \u00e9conomique, culturelle ou sociale” (personal data means any information relating to an identified or identifiable natural person, who can be identified directly or indirectly by an identifier such as a name, an identification number, location data or an online identifier”. The operator, which decides why and how accounts are managed, is the controller (responsable du traitement). Everything that follows flows from that classification.<\/p>\n

B. Five immediate steps to protect your accounts and your evidence<\/h3>\n

The operator has not confirmed any theft of personal data, and encrypted passwords are not readable as such. That is reassuring but not sufficient to do nothing, because “encrypted” does not mean “unbreakable”: weakly chosen passwords can be recovered from their encrypted form by automated guessing, and a valid email address alone is enough to receive targeted fraud. The following steps cost nothing and remain useful whatever the final findings of the investigation turn out to be.<\/p>\n

First, isolate the password. If the password used on AO3 is also used on an email inbox, a bank, a social network or a work tool, change those other passwords first, starting with the email inbox, because whoever controls an inbox can reset almost everything else. Give each sensitive account its own long password, ideally generated and stored by a password manager (gestionnaire de mots de passe). When AO3 returns, replace the AO3 password with a new unique one as well, and activate two-factor authentication (authentification a deux facteurs) if the platform offers it. This single measure neutralises the most common consequence of account database leaks, the automated replay of stolen email and password pairs on hundreds of other sites, a technique known as credential stuffing (bourrage d’identifiants).<\/p>\n

Second, treat every message about the incident with suspicion. After every widely publicised breach, forged emails and private messages appear, imitating the operator and inviting users to “verify their account”, “recover their library” or “download a backup tool”. These are phishing attempts (tentatives d’hameconnage) designed to steal the new password or install malicious software. Do not click links in unsolicited messages, even if the logo and tone look right. To check the state of the platform, type the official address yourself or follow the operator’s verified status channels, and compare any message received with those official publications before acting on it. No serious operator asks users for their password by email.<\/p>\n

Third, watch your inbox and your accounts for secondary effects. A leaked email address exposes its owner to spam, scams and targeted manipulation, sometimes months later. Be particularly careful with messages that reference fan fiction, your username or your reading to look credible, with fake invoices, alleged copyright warnings (avertissements pour violation du droit d’auteur) demanding payment, and with urgent requests for money or gift cards. If fraudulent use of your identity causes a concrete loss, keep every trace: headers of the messages, screenshots, dates, sums. These elements will support a complaint (plainte) and a claim for compensation (demande d’indemnisation), examined in the second part of this article.<\/p>\n

Fourth, exercise your data rights early rather than waiting for the full restoration. Even while the site is down, you can write to the operator to ask what personal data it holds about you and to record your requests, as explained below: access (droit d’acces), erasure (droit a l’effacement) or objection (droit d’opposition). A request sent now creates a dated record, which matters if deadlines later become disputed. Keep a copy of every request and every reply. If you decide to leave the platform, an erasure request covering the account, the email address and associated content protects you against future leaks from the same database.<\/p>\n

Fifth, preserve evidence of what you could lose. Readers with long bookmark lists, subscribers following ongoing stories, and authors with unpublished drafts (brouillons) should gather what they still have outside the platform: email notifications of comments or new chapters, downloaded copies, correspondence with co-authors. The operator states there is no data loss, and specialists recall that well-run sites keep backup copies of their databases, so collections should normally reappear. But if a work disappears or an account becomes inaccessible, a file of dated screenshots and saved messages will make any later request for restoration or compensation far easier. These reflexes mirror those recommended after other large breaches affecting French users, such as the cyberattack against the French training body Afpa, which exposed the data of about 1.7 million people and gave rise to a detailed guide on what to do, complain and claim compensation<\/a>.<\/p>\n

II. Your rights under French and European law after a data breach<\/h2>\n

A. What the platform must do: warn within 72 hours, inform users, answer requests<\/h3>\n

European law places the first obligations on the operator, not on the victims. When personal data are compromised, the controller must warn the competent authority quickly, and warn the affected people directly whenever the risk to them is high. These duties apply to the AO3 incident exactly as they would to a French company, because of the territorial scope recalled above.<\/p>\n

The central duty is the notification to the supervisory authority (notification a l’autorite de controle). Article 33 of the General Data Protection Regulation provides: “En cas de violation de donn\u00e9es \u00e0 caract\u00e8re personnel, le responsable du traitement en notifie la violation en question \u00e0 l’autorit\u00e9 de contr\u00f4le comp\u00e9tente conform\u00e9ment \u00e0 l’article 55, dans les meilleurs d\u00e9lais et, si possible, 72 heures au plus tard apr\u00e8s en avoir pris connaissance, \u00e0 moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libert\u00e9s des personnes physiques. Lorsque la notification \u00e0 l’autorit\u00e9 de contr\u00f4le n’a pas lieu dans les 72 heures, elle est accompagn\u00e9e des motifs du retard.” (In the case of a personal data breach, the controller notifies the competent supervisory authority without undue delay and, where possible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to create a risk for people’s rights and freedoms; late notification must explain the delay (Regulation (EU) 2016\/679, Article 33, EUR-Lex<\/a>). A personal data breach (violation de donnees a caractere personnel) covers any incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. A cyberattack that takes eleven million accounts offline and may have exposed the account database plainly falls within that definition, so the 72-hour clock runs from the moment the operator became aware of the attack, not from the end of its investigation. The notification must describe the nature of the breach, the categories and approximate number of people concerned, the likely consequences, and the measures taken or planned. If the operator uses a service provider hosting the data, that processor (sous-traitant) must itself warn the operator “dans les meilleurs d\u00e9lais apr\u00e8s en avoir pris connaissance” (without undue delay after becoming aware of a personal data breach”.<\/p>\n

The second duty is owed directly to users whenever the danger is serious. Article 34 of the Regulation provides: “Lorsqu’une violation de donn\u00e9es \u00e0 caract\u00e8re personnel est susceptible d’engendrer un risque \u00e9lev\u00e9 pour les droits et libert\u00e9s d’une personne physique, le responsable du traitement communique la violation de donn\u00e9es \u00e0 caract\u00e8re personnel \u00e0 la personne concern\u00e9e dans les meilleurs d\u00e9lais.” (When a personal data breach is likely to create a high risk for a person’s rights and freedoms, the controller communicates the breach to that person without undue delay (Regulation (EU) 2016\/679, Article 34, EUR-Lex<\/a>). That communication must be written in clear and plain language (en langage clair et simple) and explain the nature of the breach, a contact point, the likely consequences and the measures taken. The operator is dispensed from this individual warning in three situations only: the affected data were protected by measures such as encryption that make them unintelligible to unauthorised persons; subsequent measures have removed the high risk; or individual communication would involve disproportionate effort, in which case a public communication reaching users in an equally effective manner is required instead. Applied to AO3, the encryption of passwords is a serious argument, but it does not settle the question by itself: email addresses and usernames are not encrypted, and weak passwords remain guessable, so users are entitled to expect a transparent explanation of what was exposed, what remains uncertain, and what the operator advises them to do.<\/p>\n

Alongside these emergency duties, users hold permanent rights over their data, enforceable against the operator at any time, including now. The right to information (droit a l’information) is framed by French law: “Le droit \u00e0 l’information s’exerce dans les conditions pr\u00e9vues aux articles 12 \u00e0 14 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (The right to information is exercised under the conditions laid down in Articles 12 to 14 of Regulation (EU) 2016\/679 of 27 April 2016.) (Article 48 of Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties, Legifrance<\/a>). The right of access (droit d’acces) allows anyone to obtain confirmation of whether data about them are processed and to receive a copy: “Le droit d’acc\u00e8s de la personne concern\u00e9e s’exerce dans les conditions pr\u00e9vues \u00e0 l’article 15 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (The data subject’s right of access is exercised under the conditions laid down in Article 15 of Regulation (EU) 2016\/679 of 27 April 2016.) (Article 49 of Law No. 78-17, Legifrance<\/a>). The European text behind that reference states: “La personne concern\u00e9e a le droit d’obtenir du responsable du traitement la confirmation que des donn\u00e9es \u00e0 caract\u00e8re personnel la concernant sont ou ne sont pas trait\u00e9es et, lorsqu’elles le sont, l’acc\u00e8s auxdites donn\u00e9es \u00e0 caract\u00e8re personnel ainsi que les informations suivantes” (The data subject has the right to obtain confirmation as to whether data about them are being processed and, where that is the case, access to those data (Regulation (EU) 2016\/679, Article 15, EUR-Lex<\/a>). Concretely, a user can ask AO3 which data it stores about the account: registration email, username, IP addresses, reading history, payment data for donations, and correspondence.<\/p>\n

Correction and deletion follow the same path. French law states: “Le droit de rectification s’exerce dans les conditions pr\u00e9vues \u00e0 l’article 16 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (The right to rectification is exercised under the conditions laid down in Article 16 of Regulation (EU) 2016\/679 of 27 April 2016.) (Article 50 of Law No. 78-17, Legifrance<\/a>). And: “I.-Le droit \u00e0 l’effacement s’exerce dans les conditions pr\u00e9vues \u00e0 l’article 17 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (I. The right to erasure is exercised under the conditions laid down in Article 17 of Regulation (EU) 2016\/679 of 27 April 2016.) (Article 51 of Law No. 78-17, Legifrance<\/a>). The European provision specifies: “La personne concern\u00e9e a le droit d’obtenir du responsable du traitement l’effacement, dans les meilleurs d\u00e9lais, de donn\u00e9es \u00e0 caract\u00e8re personnel la concernant et le responsable du traitement a l’obligation d’effacer ces donn\u00e9es \u00e0 caract\u00e8re personnel dans les meilleurs d\u00e9lais, lorsque l’un des motifs suivants s’applique” (The data subject has the right to obtain erasure of their personal data without undue delay, and the controller must erase them without undue delay where one of the listed grounds applies”, including where the data “have been unlawfully processed (Regulation (EU) 2016\/679, Article 17, EUR-Lex<\/a>). Data collected during an unlawful intrusion qualify. Finally, users may object to processing: “Le droit d’opposition s’exerce dans les conditions pr\u00e9vues \u00e0 l’article 21 du r\u00e8glement (UE) 2016\/679 du 27 avril 2016.” (The right to object is exercised under the conditions laid down in Article 21 of Regulation (EU) 2016\/679 of 27 April 2016.) (Article 56 of Law No. 78-17, Legifrance<\/a>).<\/p>\n

When the operator does not answer, answers incompletely, or refuses without reason, the next step is the supervisory authority. European law gives every person this recourse: “Sans pr\u00e9judice de tout autre recours administratif ou juridictionnel, toute personne concern\u00e9e a le droit d’introduire une r\u00e9clamation aupr\u00e8s d’une autorit\u00e9 de contr\u00f4le, en particulier dans l’\u00c9tat membre dans lequel se trouve sa r\u00e9sidence habituelle, son lieu de travail ou le lieu o\u00f9 la violation aurait \u00e9t\u00e9 commise, si elle consid\u00e8re que le traitement de donn\u00e9es \u00e0 caract\u00e8re personnel la concernant constitue une violation du pr\u00e9sent r\u00e8glement.” (Without prejudice to any other administrative or judicial remedy, every data subject may complain to a supervisory authority, particularly in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of their data infringes the Regulation (Regulation (EU) 2016\/679, Article 77, EUR-Lex<\/a>). For a person living in France, that authority is the CNIL (Commission nationale de l’informatique et des libertes)<\/a>, which receives complaints (plaintes aupres de la CNIL) online. The authority must inform the complainant of the progress and outcome of the complaint. A complaint is free, does not require a lawyer, and can run alongside court proceedings: choosing one route never closes the other.<\/p>\n

B. Criminal prosecution and compensation: what French courts say<\/h3>\n

Attacking a platform’s computer systems is a criminal offence (infraction penale) in France, punished severely and independently of whether personal data were actually stolen. Three provisions of the Criminal Code (code penal) cover the conduct seen in the AO3 incident. First: “Le fait d’acc\u00e9der ou de se maintenir, frauduleusement, dans tout ou partie d’un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es est puni de trois ans d’emprisonnement et de 100 000 \u20ac d’amende. Lorsqu’il en est r\u00e9sult\u00e9 soit la suppression ou la modification de donn\u00e9es contenues dans le syst\u00e8me, soit une alt\u00e9ration du fonctionnement de ce syst\u00e8me, la peine est de cinq ans d’emprisonnement et de 150 000 \u20ac d’amende.” (Fraudulently accessing or remaining in all or part of an automated data processing system is punished by three years’ imprisonment and a 100,000 euro fine. Where this has resulted in the deletion or modification of data contained in the system, or an alteration of the functioning of that system, the penalty is five years’ imprisonment and a 150,000 euro fine.) (Article 323-1 of the Criminal Code, Legifrance<\/a>). Second, disrupting the operation of such a system: “Le fait d’entraver ou de fausser le fonctionnement d’un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es est puni de cinq ans d’emprisonnement et de 150 000 \u20ac d’amende.” (Obstructing or distorting the functioning of an automated data processing system is punished by five years’ imprisonment and a 150,000 euro fine.) (Article 323-2 of the Criminal Code, Legifrance<\/a>). A site forced offline for weeks by an attack matches this definition. Third, handling the data themselves: “Le fait d’introduire frauduleusement des donn\u00e9es dans un syst\u00e8me de traitement automatis\u00e9, d’extraire, de d\u00e9tenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les donn\u00e9es qu’il contient est puni de cinq ans d’emprisonnement et de 150 000 \u20ac d’amende.” (Fraudulently introducing data into an automated processing system, or fraudulently extracting, holding, reproducing, transmitting, deleting or modifying the data it contains, is punished by five years’ imprisonment and a 150,000 euro fine.) (Article 323-3 of the Criminal Code, Legifrance<\/a>). Copying a user database or holding it for ransom would fall under this last text.<\/p>\n

The Cour de cassation, the highest French court for criminal matters (chambre criminelle de la Cour de cassation), interprets these provisions broadly. In a judgment of 2 September 2025 (appeal No. 24-83.605, rejection), it upheld the conviction of a company network administrator who had secretly read his manager’s archived emails and even installed a hidden automatic forwarding of those messages to his own address, sentencing him to three months’ imprisonment with suspension (emprisonnement avec sursis). The Court held: “se rend coupable de l’infraction pr\u00e9vue par l’article 323-1 du code p\u00e9nal celui qui se maintient dans un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es en prenant connaissance du contenu des messages \u00e9chang\u00e9s au sein du r\u00e9seau, \u00e0 des fins \u00e9trang\u00e8res \u00e0 sa mission et \u00e0 l’insu des titulaires des messages, m\u00eame si, administrateur du r\u00e9seau, il b\u00e9n\u00e9ficie, de par ses fonctions, d’un droit g\u00e9n\u00e9ral d’acc\u00e8s \u00e0 la messagerie.” (A person is guilty of the offence laid down in Article 323-1 of the Criminal Code where he remains in an automated data processing system by reading the content of messages exchanged within the network, for purposes unrelated to his duties and without the knowledge of the owners of those messages, even if, as network administrator, his functions give him a general right of access to the messaging system.) (Court of Cassation, Criminal Chamber, 2 September 2025, No. 24-83.605<\/a>). The lesson for victims of a hack is symmetrical: authorisation to access a system never authorises its misuse, and unauthorised access remains punishable even when the intruder used technically valid credentials.<\/p>\n

Victims can trigger prosecution by filing a criminal complaint (porter plainte), for example for fraudulent access or for fraudulent extraction of data, and can join the proceedings as a civil party (constitution de partie civile) to seek damages in the same trial. The complaint can be filed at any police station or gendarmerie brigade, or by letter to the public prosecutor (procureur de la Republique) of the place of residence. Keeping the evidence listed in the first part of this article, account records, messages received, proof of any financial loss, gives the complaint its weight.<\/p>\n

Compensation can also be sought in civil proceedings, on two complementary bases. Under ordinary French law: “Tout fait quelconque de l’homme, qui cause \u00e0 autrui un dommage, oblige celui par la faute duquel il est arriv\u00e9 \u00e0 le r\u00e9parer.” (Article 1240 of the Civil Code, Legifrance<\/a>). A platform that failed to secure its systems commits a fault engaging its liability where that failure caused the leak. Under European law, the route is even more direct: “Toute personne ayant subi un dommage mat\u00e9riel ou moral du fait d’une violation du pr\u00e9sent r\u00e8glement a le droit d’obtenir du responsable du traitement ou du sous-traitant r\u00e9paration du pr\u00e9judice subi.” (Regulation (EU) 2016\/679, Article 82, EUR-Lex<\/a>). The first text states the French principle that any faulty act causing damage must be repaired; the second gives anyone who has suffered material or non-material damage from a GDPR infringement a direct right to compensation from the controller or processor. Non-material damage covers anxiety, loss of control over personal data and time spent remedying the consequences, without any need for a financial loss, but the damage must be demonstrated and connected to the infringement.<\/p>\n

For French users, the applicable time limit for bringing the civil claim is five years: “Les actions personnelles ou mobili\u00e8res se prescrivent par cinq ans \u00e0 compter du jour o\u00f9 le titulaire d’un droit a connu ou aurait d\u00fb conna\u00eetre les faits lui permettant de l’exercer.” (Personal or movable actions are time-barred after five years from the day on which the holder of a right knew or ought to have known the facts enabling him to exercise it.) (Article 2224 of the Civil Code, Legifrance<\/a>). In a breach discovered in stages, that starting point will often be the day the user learned, or should have learned, that their data were compromised, which is one more reason to keep every notification and screenshot.<\/p>\n

Conclusion<\/h2>\n

No official source has established, as this article is written, that intruders stole the AO3 user database, and none has established that user data are intact either; only the operator’s investigation and the restoration of the service will settle the question. What is certain is that eleven million accounts, including those of French and European readers, sat for weeks on attacked systems, and that the law does not leave those readers powerless. Change exposed passwords starting with the email inbox, distrust any message invoking the incident, monitor accounts for fraud, exercise access and erasure rights in writing, and preserve evidence of accounts and losses. On the legal side, the operator owes notification within 72 hours and a plain-language warning whenever the risk is high, users hold rights of access, rectification, erasure and objection enforceable today, the CNIL can be seized by complaint, the criminal law punishes the intrusion with up to five years’ imprisonment, and compensation for material or non-material damage can be claimed within five years of discovering the facts. The outage will end; the rights remain, and exercising them promptly is the surest way to turn a period of forced waiting into a protected position.<\/p>\n","protected":false},"excerpt":{"rendered":"

AO3 has been down since 29 October 2026 after a cyberattack. What happened to user data, what to do now, and your GDPR rights in France and the EU.<\/p>\n","protected":false},"author":251031309,"featured_media":16399,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kj_source_type":"","_kj_official_id":"","_kj_official_url":"","_kj_judilibre_id":"","_kj_jur":"","_kj_lieu":"","_kj_chambre":"","_kj_rg":"","_kj_date":"","activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[80314,80316],"tags":[],"class_list":["post-2163046","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-decryptage","category-numerique-donnees-personnelles"],"yoast_head":"\nAO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU - Ma\u00eetre Reda Kohen, Real Estate and Business Law Attorney in Paris<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU\" \/>\n<meta property=\"og:description\" content=\"AO3 has been down since 29 October 2026 after a cyberattack. What happened to user data, what to do now, and your GDPR rights in France and the EU.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/\" \/>\n<meta property=\"og:site_name\" content=\"Ma\u00eetre Reda Kohen, Real Estate and Business Law Attorney in Paris\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-07T04:40:20+00:00\" \/>\n<meta name=\"author\" content=\"Kohen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kohen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"22 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/\"},\"author\":{\"name\":\"Kohen\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#\\\/schema\\\/person\\\/6254a643e6239d803134a01c800381bd\"},\"headline\":\"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU\",\"datePublished\":\"2026-11-07T04:40:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/\"},\"wordCount\":4436,\"publisher\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kohenavocats.fr\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp\",\"articleSection\":[\"D\u00e9cryptage\",\"Num\u00e9rique et donn\u00e9es personnelles\"],\"inLanguage\":\"en-US\",\"citation\":\"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU\",\"about\":[{\"@type\":\"Thing\",\"name\":\"D\u00e9cryptage\"},{\"@type\":\"Thing\",\"name\":\"Num\u00e9rique et donn\u00e9es personnelles\"}],\"dateModified\":\"2026-11-07T04:40:20+00:00\",\"speakable\":{\"@type\":\"SpeakableSpecification\",\"cssSelector\":[\".article-content > p:first-of-type\"]}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/\",\"url\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/\",\"name\":\"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU - Ma\u00eetre Reda Kohen, Real Estate and Business Law Attorney in Paris\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kohenavocats.fr\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp\",\"datePublished\":\"2026-11-07T04:40:20+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kohenavocats.fr\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp\",\"contentUrl\":\"https:\\\/\\\/kohenavocats.fr\\\/wp-content\\\/uploads\\\/2024\\\/11\\\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp\",\"width\":6016,\"height\":4016},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/2026\\\/11\\\/07\\\/ao3-down-hack-protect-account-data-rights-france-eu\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/\",\"name\":\"Kohen Avocats\",\"description\":\"Ma\u00eetre Reda Kohen, attorney specialized in real estate and business law in Paris, advises and assists companies and individuals in their real estate, commercial and contractual transactions. He also handles real estate litigation and the resolution of complex commercial disputes.\",\"publisher\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#organization\",\"name\":\"Kohen Avocats\",\"url\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/kohenavocats.fr\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/Logo-2-1.webp\",\"contentUrl\":\"https:\\\/\\\/kohenavocats.fr\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/Logo-2-1.webp\",\"width\":2114,\"height\":1253,\"caption\":\"Kohen Avocats\"},\"image\":{\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/#\\\/schema\\\/person\\\/6254a643e6239d803134a01c800381bd\",\"name\":\"Kohen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1c5e76ef76bbbfdd2b4da984e2bf2fa4056fd51a27d25ce2c332047f1dfd6e00?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1c5e76ef76bbbfdd2b4da984e2bf2fa4056fd51a27d25ce2c332047f1dfd6e00?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1c5e76ef76bbbfdd2b4da984e2bf2fa4056fd51a27d25ce2c332047f1dfd6e00?s=96&d=identicon&r=g\",\"caption\":\"Kohen\"},\"url\":\"https:\\\/\\\/kohenavocats.fr\\\/en\\\/author\\\/kohenmlk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU - Ma\u00eetre Reda Kohen, Real Estate and Business Law Attorney in Paris","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/","og_locale":"en_US","og_type":"article","og_title":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU","og_description":"AO3 has been down since 29 October 2026 after a cyberattack. What happened to user data, what to do now, and your GDPR rights in France and the EU.","og_url":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/","og_site_name":"Ma\u00eetre Reda Kohen, Real Estate and Business Law Attorney in Paris","article_published_time":"2026-11-07T04:40:20+00:00","author":"Kohen","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kohen","Est. reading time":"22 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#article","isPartOf":{"@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/"},"author":{"name":"Kohen","@id":"https:\/\/kohenavocats.fr\/en\/#\/schema\/person\/6254a643e6239d803134a01c800381bd"},"headline":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU","datePublished":"2026-11-07T04:40:20+00:00","mainEntityOfPage":{"@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/"},"wordCount":4436,"publisher":{"@id":"https:\/\/kohenavocats.fr\/en\/#organization"},"image":{"@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#primaryimage"},"thumbnailUrl":"https:\/\/kohenavocats.fr\/wp-content\/uploads\/2024\/11\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp","articleSection":["D\u00e9cryptage","Num\u00e9rique et donn\u00e9es personnelles"],"inLanguage":"en-US","citation":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU","about":[{"@type":"Thing","name":"D\u00e9cryptage"},{"@type":"Thing","name":"Num\u00e9rique et donn\u00e9es personnelles"}],"dateModified":"2026-11-07T04:40:20+00:00","speakable":{"@type":"SpeakableSpecification","cssSelector":[".article-content > p:first-of-type"]}},{"@type":"WebPage","@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/","url":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/","name":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU - Ma\u00eetre Reda Kohen, Real Estate and Business Law Attorney in Paris","isPartOf":{"@id":"https:\/\/kohenavocats.fr\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#primaryimage"},"image":{"@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#primaryimage"},"thumbnailUrl":"https:\/\/kohenavocats.fr\/wp-content\/uploads\/2024\/11\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp","datePublished":"2026-11-07T04:40:20+00:00","breadcrumb":{"@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#primaryimage","url":"https:\/\/kohenavocats.fr\/wp-content\/uploads\/2024\/11\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp","contentUrl":"https:\/\/kohenavocats.fr\/wp-content\/uploads\/2024\/11\/kateryna-hliznitsova-cSf0iO7Txkw-unsplash-scaled.webp","width":6016,"height":4016},{"@type":"BreadcrumbList","@id":"https:\/\/kohenavocats.fr\/en\/2026\/11\/07\/ao3-down-hack-protect-account-data-rights-france-eu\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kohenavocats.fr\/en\/"},{"@type":"ListItem","position":2,"name":"AO3 Down After Hack: What to Do to Protect Your Account and Your Data Rights in France and the EU"}]},{"@type":"WebSite","@id":"https:\/\/kohenavocats.fr\/en\/#website","url":"https:\/\/kohenavocats.fr\/en\/","name":"Kohen Avocats","description":"Ma\u00eetre Reda Kohen, attorney specialized in real estate and business law in Paris, advises and assists companies and individuals in their real estate, commercial and contractual transactions. He also handles real estate litigation and the resolution of complex commercial disputes.","publisher":{"@id":"https:\/\/kohenavocats.fr\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kohenavocats.fr\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kohenavocats.fr\/en\/#organization","name":"Kohen Avocats","url":"https:\/\/kohenavocats.fr\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kohenavocats.fr\/en\/#\/schema\/logo\/image\/","url":"https:\/\/kohenavocats.fr\/wp-content\/uploads\/2024\/05\/Logo-2-1.webp","contentUrl":"https:\/\/kohenavocats.fr\/wp-content\/uploads\/2024\/05\/Logo-2-1.webp","width":2114,"height":1253,"caption":"Kohen Avocats"},"image":{"@id":"https:\/\/kohenavocats.fr\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/kohenavocats.fr\/en\/#\/schema\/person\/6254a643e6239d803134a01c800381bd","name":"Kohen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1c5e76ef76bbbfdd2b4da984e2bf2fa4056fd51a27d25ce2c332047f1dfd6e00?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1c5e76ef76bbbfdd2b4da984e2bf2fa4056fd51a27d25ce2c332047f1dfd6e00?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1c5e76ef76bbbfdd2b4da984e2bf2fa4056fd51a27d25ce2c332047f1dfd6e00?s=96&d=identicon&r=g","caption":"Kohen"},"url":"https:\/\/kohenavocats.fr\/en\/author\/kohenmlk\/"}]}},"_links":{"self":[{"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/posts\/2163046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/users\/251031309"}],"replies":[{"embeddable":true,"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/comments?post=2163046"}],"version-history":[{"count":0,"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/posts\/2163046\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/media\/16399"}],"wp:attachment":[{"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/media?parent=2163046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/categories?post=2163046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kohenavocats.fr\/en\/wp-json\/wp\/v2\/tags?post=2163046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}