Fanlore (Organization for Transformative Works) data breach

What happened

According to HIBP, the Organization for Transformative Works (OTW) identified unauthorized access to its Fanlore wiki in August 2026. OTW self-reported the incident and submitted the exposed data directly to HIBP.

What was exposed

The breach exposed roughly 145,000 unique email addresses along with usernames, names, and passwords. Reported by HIBP, the passwords were stored as hashes using either MD5 or PBKDF2 algorithms. MD5 hashes are considered weak and may be cracked more easily than PBKDF2.

Who is affected

Anyone with a registered account on the Fanlore wiki at the time of the breach may be affected. Fanlore is a fan-run wiki operated by OTW, the nonprofit behind Archive of Our Own (AO3).

What to do now

Change your Fanlore password immediately if you have not already done so.
If you reused that password on any other site, change it there as well.
Use a unique, strong password for each account going forward, and consider a password manager.
Watch for phishing emails targeting your exposed email address.