Cyber Incident Victim: Archive of Our Own
Date:
Jul 2023
Location:
—
Summary
Archive of Our Own (AO3), a major fanfiction website, was targeted by a cyberattack. The attack was a distributed denial-of-service (DDoS) that caused a service outage. A group claiming religious and political motivations took responsibility, though experts expressed doubt about the legitimacy of these claims. The site's volunteer administrators worked to mitigate the attack and restore service for its large user community.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around July 10, 2023, the prominent online fanfiction library and community known as Archive of Our Own, commonly referred to as AO3, fell victim to a significant cyberattack. The incident was publicly communicated by the site's administrators via their Twitter account, where they indicated the platform was suffering from a denial-of-service attack. This specific type of cyberattack functions by overwhelming a website with a massive volume of simultaneous requests, deliberately orchestrated to cause service disruption and make the site dysfunctional. As of the morning of July 11, the attack had not been successfully contained, and the website remained inaccessible to its vast user base. The initial tweet announcing the outage garnered significant attention, being retweeted nearly 14,000 times and receiving over 87,000 likes, a clear indicator of the platform's substantial popularity and the widespread concern regarding its operational status.
The administrators, who are identified as volunteers, were actively working to counteract the attacks and restore service. In their communications, they requested patience from the community while these mitigation efforts were underway. Furthermore, the site provided additional context regarding the threat actor behind the incident. They stated that a group presenting itself as a collective with stated religious and political motivations had publicly claimed responsibility for the cyberattack. However, the administrators included a cautionary note, advising users to be very careful before believing the reasons the group had put forward. They mentioned that experts had expressed doubts about the honesty of these claimed motivations, suggesting the publicly stated rationale might be a misdirection or not the full story.
Archive of Our Own is a major participatory and community-driven website that hosts millions of fan-created works. These works, known as fanfictions, are imaginative stories written by fans that reinterpret and expand upon existing popular characters and universes from a wide array of media. Since its creation in 2009, AO3 has grown into an immensely popular platform, particularly among younger demographics. By 2021, it already hosted more than eight million individual works and had surpassed the milestone of four million registered users. The site is structured as a non-profit organization and is managed entirely by a team of volunteers, underscoring its community-centric ethos. The content on AO3 spans over 45,000 distinct fan communities, covering hugely popular franchises such as Harry Potter, Marvel, Sherlock, Supernatural, Attack on Titan, and The Legend of Zelda video games, among countless others.
The significance of AO3 within both fandom and broader cultural circles was formally recognized in 2019 when it was awarded the prestigious Hugo Award. This literary prize is traditionally bestowed upon works of science fiction and fantasy, and AO3's win marked the first time a collaborative website of its nature, hosting such an enormous volume of user-generated content, had ever received this distinction. This accolade highlights the platform's role not just as an archive but as a culturally important space for creative expression and community building. The cyberattack therefore targeted a resource of considerable value to its millions of users, disrupting access to a massive repository of creative work and a key hub for online community interaction.
The denial-of-service attack represents a direct assault on the availability of the service, which is a core tenet of information security. By flooding the site's infrastructure with traffic, the attackers aimed to exhaust resources and prevent legitimate users from accessing the platform. The sustained nature of the attack, which persisted for at least a full day as confirmed by its continued inaccessibility on the morning of July 11, indicates a determined effort to cause prolonged disruption. The fact that the volunteer administrators were engaged in a battle to counter these attacks speaks to the challenges faced by non-profit organizations in defending against such aggressive and resource-intensive threats. The scale of the attack necessitated a significant response effort from the team working to mitigate its effects and restore normal operations.
The public claim of responsibility by a group adds a layer of complexity to the incident. While the group's stated motivations were religious and political in nature, the skepticism voiced by experts and echoed by the AO3 administration suggests that the true motives may be different or more obscure. Such claims can sometimes be a form of propaganda or an attempt to garner attention for a cause, and the caution advised to users implies a need for critical assessment of the information surrounding the attackers. The incident underscores the vulnerability of online communities, even large and well-established ones, to targeted disruptions. The impact was felt immediately by a global user base reliant on the site for entertainment, creativity, and social connection, demonstrating how cyber incidents can have tangible effects on cultural and social activities. The work of the volunteer administrators to diagnose, respond to, and recover from this attack is a central part of the incident narrative, highlighting the human effort required to maintain such a vast digital commons in the face of malicious activity.