The Organization for Transformative Works (OTW), which runs the fanfiction site Archive of Our Own (AO3), said it found evidence of a security incident. AO3 is offline during the investigation. OTW said no AO3 data has been deleted, and that works, bookmarks and kudos are safe. It expects the outage to last at least two weeks, possibly four. It may restore a limited version sooner, possibly read-only, but could take the site down again without notice.
OTW said it does not currently believe the user database was stolen, but it cannot rule that out. These are separate questions. Not deleted means the content still exists. Not stolen would mean no one else holds a copy. The notice is firm on the first and open on the second. The database may hold usernames, email addresses, IP addresses and hashed passwords. A hash scrambles a password so it cannot easily be reversed. OTW said a weak or reused password can still be cracked, so it advises changing any matching password on other sites. The notice does not say what happened.
For teams that run user accounts, the notice shows how a statement can be honest and still leave users unable to judge their exposure. Leaders can ask whether their team could say early what was not deleted, what is unconfirmed, which account fields are stored, and which passwords users should change.