LEGO’s BrickLink taken offline: What users should know

LEGO collectors and independent sellers face disruption as the company has taken BrickLink offline following detection of what it calls "unusual activity." The specialized marketplace, which LEGO acquired in 2019, allows users to buy and sell LEGO parts, sets, and minifigures. The company is investigating before bringing the platform back online but has not disclosed whether attackers accessed its systems or compromised customer information.

Investigation ongoing

The BrickLink website previously indicated it would remain unavailable until at least Wednesday, November 11, but that date has now been removed with no replacement timeline provided. LEGO stated in a notice: "We took BrickLink offline after identifying unusual activity on the platform. Our immediate priority was to secure the site, protect our members and ensure the integrity of BrickLink."

Before bringing the site back online, we need to fully understand what has happened. That means containing the issue, investigating how it happened and checking for related issues.

User concerns

According to the BBC, LEGO has not provided details confirming a hack or explaining whether customer data was affected. Specialist LEGO publications reported that BrickLink went offline around November 5, with users unable to access storefronts, profiles, order histories, or the Designer Program page. This isn't the first time BrickLink has faced issues—it closed down in November 2023 due to credential stuffing attacks.

The BBC also reported a case where a BrickLink customer received repeated payment links for a limited-edition preorder she claimed she had already paid for. While LEGO stated it was not aware of wider payment issues, there is no established connection between that incident and the current shutdown.

Safety precautions

Until the issue is fully understood, LEGO advises users to watch for unexpected account or payment messages, as these could be phishing attempts. Users should verify requests through official channels rather than following links in unexpected communications. The company strongly recommends using unique passwords and changing any reused credentials on other services immediately.

While the shutdown is disruptive, available evidence does not yet confirm a data breach. Users are encouraged to follow official updates, carefully check any unexpected payment requests, and remain vigilant against scams exploiting the outage.