Lego has taken BrickLink, its marketplace for second-hand sets and individual bricks, offline after spotting what it calls “unusual activity” on the platform. The company has given no return date and has not said whether member data was affected, so UK collectors and the small businesses that sell through the site are left waiting.
What happened
BrickLink is a large online marketplace where independent sellers trade Lego parts, minifigures, used sets and limited editions. A fan built it, and the Lego Group bought it in 2019. The holding page first blamed maintenance. It now says only that the site is temporarily unavailable.
Lego explained more in an update dated 11 November. Infosecurity Magazine reported the update, and Euronews said it was also shared through the community site Jay’s Brick Blog. According to the BBC, Lego published it after the broadcaster contacted the company. Lego said its first task was to “secure the site, protect our members and ensure the integrity of BrickLink”. It added that the site would stay down until it fully understood what had happened, which meant containing the problem, working out how it occurred and checking for related issues.
The reports disagree on when the outage started. Euronews, writing on 12 November, said the site came down on 5 November. In its report the BBC described it as offline for the previous three days. The BBC also said a notice promising a return by Wednesday evening (11 November) was later removed, and that no new timeframe had replaced it. Lego has not confirmed a start date.
Lego has not said whether this was a cyber attack, whether any systems were compromised or whether customer data was involved. No group has publicly claimed responsibility.
The detail
On the cause, the public record holds only what Lego has chosen to share, and that is very little. “Unusual activity” can mean anything from an intrusion to a traffic spike, and outsiders should not guess which. What the statement does show is a standard incident response sequence: contain, investigate, then check for related or follow-on problems before bringing the service back.
One user account adds some background but no proof. Melanie Hoskin, a long-standing collector who works in cyber security, told the BBC she kept receiving payment requests for a limited-edition pre-order she had already paid for. She said Lego at one point questioned whether she had paid and suggested she could be banned. Lego told the BBC the issue had been fixed and that it knew of no wider payment problems. The BBC noted that it was unclear whether the glitch was connected to the outage.
BrickLink has had security problems before. In 2022, researchers at Salt Labs reported API weaknesses that could have let an attacker take over user accounts, expose personal data and reach internal production data. Lego fixed those issues after disclosure. In November 2023 the marketplace went offline for several days during a suspected security incident, and users were asked to change their passwords at the time. None of this explains the current outage.
Why it matters for UK organisations
BrickLink’s sellers include UK sole traders and micro-businesses, some of whom trade mainly or only through the platform. Days without sales hurt them directly. Xavier Bellekens, chief executive of Lupovis, told Euronews that every extra day offline costs real money for the businesses that rely on the marketplace. When a small firm depends on one platform, that platform’s incident becomes its incident too.
There is a data protection angle too, though for now it is conditional. Lego has not said any personal data was affected. If it later finds that UK users’ data was, UK GDPR obligations would apply, including a duty to assess the risk to individuals and, where the threshold is met, to report to the regulator and tell those affected. UK sellers also hold their own customers’ names and addresses through the platform, so they should know what they would have to do if the platform operator reported a breach.
The phishing risk is more immediate and needs no breach at all. A well-known brand, a frustrated user base and an outage in the news are all criminals need for convincing lures. Bellekens warned users to be wary of emails claiming to come from BrickLink, especially those asking them to reset passwords, confirm payment details or move to another marketplace.
Expert view
Taking a revenue-generating platform completely offline is a costly decision, and companies rarely make it lightly. In my experience it usually means the incident team could not confidently keep the threat away from the live service while it stayed up. The decision deserves credit.
The communications deserve less credit. Moving from “maintenance” to “unusual activity”, publishing a return time and then deleting it, and making the fuller statement only after a national broadcaster asked: all of this erodes trust. When we run incident exercises with clients, the communications plan often gets the least practice. A short, honest message that admits what is not yet known usually ages better.
The history matters as well. A marketplace with published API flaws in 2022, a suspected incident in 2023 and another unexplained shutdown now will face questions about whether earlier root causes were fully dealt with. Lego’s post-incident review should answer that clearly.
What to do now
- Treat all BrickLink-themed emails with suspicion. Do not click password reset or payment verification links. Go to the site directly once it is back, and report suspicious messages to the NCSC’s Suspicious Email Reporting Service (report@phishing.gov.uk).
- Change reused passwords now. If your BrickLink password is used anywhere else, change it on those services and switch on multi-factor authentication wherever it is offered. This matches the Cyber Essentials user access control requirements.
- Change your BrickLink password when the site returns. Do this whether or not Lego asks you to, and check your stored payment, payout and address details for any unexpected changes.
- Sellers: keep your own records. Keep an offline copy of current orders and buyer contact details so you can fulfil and talk to customers during outages, and handle that copy securely as personal data.
- Plan for platform outages. Small businesses that depend on one marketplace should record that dependency in their risk register and consider a second sales channel or a simple continuity plan.
- Know your breach duties. Make sure someone in the business knows how to assess whether a third-party incident involving customer data needs reporting to the ICO, and how to do it within 72 hours.
Bottom line
Lego has done the hard part by pulling BrickLink offline and saying it will not restore the site until it understands what happened. It has not said what the unusual activity was, whether data was involved or when the site will return, and it would be wrong to fill those gaps with guesswork. For now, UK users and sellers should expect scam emails, tidy up their passwords and wait for Lego’s full explanation, which should cover the platform’s earlier problems too.
Sources
- Infosecurity Magazine: Lego Takes BrickLink Marketplace Offline After Detecting Unusual Activity
- Euronews: LEGO shop BrickLink downed by ‘unusual activity’ on its website
- BBC (via Shango Media): Lego marketplace BrickLink offline after ‘unusual activity’ detected
- IndexBox: LEGO’s BrickLink Marketplace Remains Offline After Unusual Platform Activity
