BrickLink Lego marketplace is back online after security incident | The Verge

Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
BrickLink went down on November 3rd after a possible security breach. Now, it’s back online and asking all users to change their passwords.
BrickLink went down on November 3rd after a possible security breach. Now, it’s back online and asking all users to change their passwords.
Posts from this author will be added to your daily email digest and your homepage feed.
See All by Umar Shakir
BrickLink, an online Lego parts marketplace owned by Lego, is back online after several days of downtime due to a cybersecurity incident that apparently targeted some merchant accounts. The company said it received a “threat and ransom demand” last Friday, presumably in regard to company or user data, leading it to shut down the site “out of an abundance of caution.”
The site has been detecting “limited suspicious activity” since mid-October, where unauthorized sellers fraudulently attempted to collect money through unrealistically discounted listings.
BrickLink says a “relatively small” amount of accounts may have been compromised but does not see any evidence that its systems were breached. It says “credential stuffing” occurred, where bad actors input compromised passwords from other sources to try to break into owners’ accounts on different sites.
Lego reviewer and blogger Jay Ong, who writes for Jay’s Brick Blog, posted that they received a message from BrickLink that all users must change their passwords. Ong says they were assured their BrickLink account was not compromised. Notably, BrickLink does not yet offer two-factor authentication, although it plans to in the future.
Correction November 8th, 8:43PM ET: BrickLink is owned by Lego; we previously called it an unofficial marketplace. We regret the error.
Posts from this author will be added to your daily email digest and your homepage feed.
See All by Umar Shakir
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
Posts from this topic will be added to your daily email digest and your homepage feed.
A free daily digest of the news that matters most.
This is the title for the native ad
This is the title for the native ad
The Verge is a part of PMX Global, LLC, a subsidiary of Penske Media Corporation.
© 2026 VM Publishing, LLC. All rights reserved.
Sign in to see your notifications or create an account to join the conversation.