Fur Affinity has been "pulled offline temporarily" after users' accounts and submissions went missing.
Update (21 May): FA returned for a day, but is now in read-only mode. Passwords were said to be hashed and salted, but if you've used the same one elsewhere, now is the time to change it to be unique per-site.
Update 2 (23 May): Fur Affinity has returned; however, all passwords have been reset, which is causing problems for those with an old/invalid email address.
It has been confirmed that an exploit was used to copy Fur Affinity's source code, later distributed at Biggest Little Fur Con. A subsequent attack deleted user profiles, submissions, and watches.
FA users took to Twitter and the Fur Affinity Forums looking for answers – which appeared to have been preemptively provided by a post asking "What would you do if you found an exploit on FA?", posted last Sunday on the Phoenixed Forums. However, more recent posts by the original poster disclaim responsibility.
The recent "ImageTragick" vulnerability in widely-used processing library ImageMagick was soon turned into an exploit and has been identified by FA as the original attack vector.
Fur Affinity community manager Dragoneer reports that backups exist, but are six days old:
The majority [of the site's data is secure], yes. The backup we have is 6 days old. We're still going through and trying to determine the extent of the issue, and once we have more information, we'll post it publicly and give a full, transparent run down of what happened.