Lego takes BrickLink Marketplace offline after unusual activity

Lego Group said on Nov. 11, 2026, that it disabled its BrickLink Marketplace after detecting unusual activity on the platform.

The marketplace went offline around Nov. 5, blocking access to storefronts, profiles, order histories and the Designer Program page, Lego-focused publications reported. Brick Fanatics said on Nov. 6 that Lego extended maintenance for two days without further explanation. The original maintenance was set to end at 7 p.m. GMT but ran until 6 p.m. CET / 9 a.m. PST on Nov. 9, keeping the platform offline all weekend. Lego said, “We took BrickLink offline after identifying unusual activity on the platform.”

In its Nov. 11 update, Lego said its priorities are securing the platform, safeguarding members and verifying BrickLink’s integrity before restoring service. The company said it must investigate the incident, contain the issue and check for related problems before bringing the marketplace back online, and it has not disclosed how long the downtime will last. BrickLink’s own site had set a return target of at least Wednesday, Nov. 11, then removed the date without a replacement. Lego said, “Our immediate priority was to secure the site, protect our members and ensure the integrity of BrickLink.”

BrickLink, an online marketplace where third-party vendors trade individual Lego parts that Lego Group acquired in 2019, lets users buy and sell parts, sets and minifigures, and independent sellers depend on access to orders and storefronts. One seller said thousands of independent storefronts closed during the holiday shopping season with almost no meaningful explanation from Lego, and questioned whether seller information is safe and what steps Lego is taking to prevent more disruptions. Brick Fanatics said it contacted the Lego Group about the extended downtime and had not heard back by publication time.

Security problems have hit the platform before. Salt Labs examined BrickLink in 2022 and found API vulnerabilities that could have let attackers hijack accounts, expose personal data and access internal production systems; Lego subsequently fixed them. The November 2023 multi-day shutdown, which resulted from a suspected cybersecurity incident, was later traced to credential stuffing attacks, in which attackers reuse stolen usernames and passwords, and a separate 2022 cyber incident caused extended downtime without compromising data.

Malwarebytes reported that Lego has not confirmed whether a hack occurred or whether user information was compromised, and said current evidence is not enough to label the outage a confirmed data breach. Reviewer Jay Ong, who runs Jay’s Bricks Blog, said users received prompts to update their passwords during the downtime and that an e-mail reassured him his own account had not been compromised.

One customer received payment requests for a preorder she believed she had already paid for, Malwarebytes reported. The matter was settled, Lego told the BBC it was unaware of broader payment problems, and investigators found no tie between that issue and the unusual activity.

Malwarebytes urged people to watch for unexpected account or payment requests, to confirm demands through separate channels, to avoid reusing passwords and to update their BrickLink password after the marketplace returns. It also advised following official updates and staying alert to outage-related scams.