LEGO’s BrickLink taken offline: What users should know

LEGO collectors looking for a missing piece have a bigger problem to contend with: accessing the specialized marketplace BrickLink.

LEGO has taken BrickLink offline after detecting what it calls “unusual activity.” The company says it is investigating before bringing the marketplace back, but has not disclosed whether attackers accessed its systems or whether customer information was affected.

BrickLink allows users to buy and sell LEGO parts, sets, and minifigures, making it a useful resource for collectors and a business platform for independent sellers. LEGO acquired the fan-founded marketplace in 2019. Its disruption leaves more than unfinished builds on hold: sellers also depend on access to orders and their storefronts.

The BrickLink website previously said it would remain unavailable until at least Wednesday, November 11. That date has now been removed, with no replacement given.

We took BrickLink offline after identifying unusual activity on the platform. Our immediate priority was to secure the site, protect our members and ensure the integrity of BrickLink.

Before bringing the site back online, we need to fully understand what has happened. That means containing the issue, investigating how it happened and checking for related issues.

This work is still on-going and we appreciate your patience while we work to get things back online as soon as possible.

Updated: 11th November 2026

According to the BBC, LEGO had not provided details confirming a hack or explaining whether customer data was affected.

Specialist LEGO publications reported that BrickLink went offline around November 5. An article published the following morning described a notice saying the site was unavailable while teams carried out “necessary work.” That report also noted that users could not access storefronts, profiles, order histories, or the Designer Program page.

In November 2023, BrickLink also closed down after it noticed what turned out to be credential stuffing attacks.

The BBC also reported the experience of a BrickLink customer who received repeated payment links for a limited-edition preorder she said she had already paid for. The dispute was subsequently resolved, and LEGO told the BBC it was not aware of wider payment issues. But there is no established connection between that payment problem and the activity that prompted the shutdown.

How to stay safe

Until we know what the issue is, it is hard to provide targeted advice, but users can take a few proportionate precautions:

• Watch for unexpected account or payment messages. A request to “restore access,” confirm payment information, or resolve an urgent account problem deserves scrutiny, because these are common phishing themes.
• Verify requests through an independent route. Use the official website or an established support channel rather than following links in an unexpected email or text.
• Use unique passwords. If your BrickLink password is also used elsewhere, change it on those other services now. Use a password manager to generate and store strong, unique passwords. Change your BrickLink password once the site is available again.

BrickLink’s shutdown is disruptive, but the available evidence does not yet justify calling it a confirmed data breach. For now, the priority for users is to follow official updates, check unexpected payment requests carefully, and watch for scams exploiting the outage.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free →