{"id":"CMP-202611-iatwa6","kind":"campaign","aliases":[],"related":[],"title":"LEGO takes its BrickLink marketplace offline after 'unusual activity'; whether customer data was taken is unknown, so expect phishing posing as BrickLink","description":null,"summary":"LEGO's BrickLink marketplace for LEGO parts, sets and minifigures has been offline since about 5 Nov 2026. LEGO says it took the site down after finding unusual activity and is investigating. It has not confirmed a hack or said whether customer data was affected. The planned date to come back (11 Nov) has been removed. Sellers cannot reach storefronts, orders or profiles. One customer got repeated payment links for a preorder she had already paid for; LEGO says it knows of no wider payment issue, and no link to the incident is known. BrickLink had a credential-stuffing shutdown in Nov 2023.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BrickLink","fixed":[],"affected":"all accounts","ecosystem":"vendor"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Unexpected emails or texts about BrickLink: restoring access, confirming payment details, an urgent account problem, or payment links for orders. Sender domains and subject lines: unknown, none published yet. A real BrickLink notice will not need you to pay or enter your card through a link while the site is down.","fix":"Do not click links in unexpected BrickLink payment or account messages. Check orders only through the official site once it is back. If you used your BrickLink password anywhere else, change it there now. Change your BrickLink password when the site returns. Sellers: tell buyers that payment requests do not come by surprise links.","status":"open","published_at":null,"first_seen_at":"2026-11-12T14:54:50+00:00","triaged_at":"2026-11-12T14:54:50+00:00","updated_at":"2026-11-12T14:56:10+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-12T14:59:18Z","path":"unknown","entry":"unknown","reason":"The record says LEGO has 'not confirmed a hack' and is investigating, and that no link between the payment links and the incident is known, so neither the entry method nor the route to users is stated.","confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-202611':24A '11':82B '2023':134B '2026':48B '5':46B 'activ':9A,59B 'affect':75B 'alreadi':105B 'back':81B 'bricklink':4A,22A,26A,33B,125B 'campaign':27B 'cannot':88B 'cmp':23A 'come':80B 'confirm':66B 'credenti':129B 'credential-stuf':128B 'custom':11A,72B,95B 'data':12A,73B 'date':78B 'earli':29B 'early-warn':28B 'expect':18A 'find':57B 'got':96B 'hack':68B 'iatwa6':25A 'incid':122B 'investig':62B 'issu':116B 'know':111B 'known':124B 'lego':1A,31B,36B,49B,108B 'link':99B,119B 'marketplac':5A,34B 'minifigur':40B 'nov':47B,83B,133B 'offlin':6A,43B 'one':94B 'order':91B 'paid':106B 'part':37B 'payment':98B,115B 'phish':19A 'plan':77B 'pose':20A 'preorder':102B 'profil':93B 'reach':89B 'remov':86B 'repeat':97B 'said':70B 'say':50B,109B 'seller':87B 'set':38B 'shutdown':131B 'sinc':44B 'site':54B 'storefront':90B 'stuf':130B 'take':2A 'taken':14A 'took':52B 'unknown':16A 'unusu':8A,58B 'warn':30B 'whether':10A,71B 'wider':114B","nicknames":["BrickLink outage"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["bricklink","bricklinkoutage"],"ptokens":["bricklink"],"labels":["campaign","earlywarning","medium","vendor"],"campaign_type":"breach","search_a":"'-202611':24A 'activ':9A 'bricklink':4A,22A,26A 'cmp':23A 'custom':11A 'data':12A 'expect':18A 'iatwa6':25A 'lego':1A 'marketplac':5A 'offlin':6A 'phish':19A 'pose':20A 'take':2A 'taken':14A 'unknown':16A 'unusu':8A 'whether':10A","search_b":"'11':82B '2023':134B '2026':48B '5':46B 'activ':59B 'affect':75B 'alreadi':105B 'back':81B 'bricklink':33B,125B 'campaign':27B 'cannot':88B 'come':80B 'confirm':66B 'credenti':129B 'credential-stuf':128B 'custom':72B,95B 'data':73B 'date':78B 'earli':29B 'early-warn':28B 'find':57B 'got':96B 'hack':68B 'incid':122B 'investig':62B 'issu':116B 'know':111B 'known':124B 'lego':31B,36B,49B,108B 'link':99B,119B 'marketplac':34B 'minifigur':40B 'nov':47B,83B,133B 'offlin':43B 'one':94B 'order':91B 'paid':106B 'part':37B 'payment':98B,115B 'plan':77B 'preorder':102B 'profil':93B 'reach':89B 'remov':86B 'repeat':97B 'said':70B 'say':50B,109B 'seller':87B 'set':38B 'shutdown':131B 'sinc':44B 'site':54B 'storefront':90B 'stuf':130B 'took':52B 'unusu':58B 'warn':30B 'whether':71B 'wider':114B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":"2026-11-12T15:05:53+00:00","first_public_at":"2026-11-12T14:25:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-iatwa6","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-12T14:54:50+00:00","fetched_at":"2026-11-12T14:54:50+00:00","note":null}],"documents":[{"id":135574,"url":"https://www.malwarebytes.com/blog/news/2026/11/legos-bricklink-taken-offline-after-unusual-activity-what-users-should-know","title":"Malwarebytes Labs: LEGO’s BrickLink taken offline: What users should know","kind":"blog","source":"blog","publisher":null,"text":"LEGO’s BrickLink taken offline: What users should know\n\nBrickLink, the LEGO marketplace, has gone offline after detecting unusual activity, without disclosing whether customer data was affected.","published_at":"2026-11-12T14:25:49+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}