---
id: "CMP-202611-iatwa6"
page: "https://infrastack.ai/live/CMP-202611-iatwa6"
kind: "campaign"
aliases: []
title: "LEGO takes its BrickLink marketplace offline after 'unusual activity'; whether customer data was taken is unknown, so expect phishing posing as BrickLink"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "BrickLink", "fixed": [], "affected": "all accounts", "ecosystem": "vendor"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-12T14:54:50+00:00"
updated_at: "2026-11-12T14:56:10+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-12T14:54:50+00:00"}]
exploit_sources: []
---

# LEGO takes its BrickLink marketplace offline after 'unusual activity'; whether customer data was taken is unknown, so expect phishing posing as BrickLink

Link for people: https://infrastack.ai/live/CMP-202611-iatwa6 (this .md is for agents)

LEGO's BrickLink marketplace for LEGO parts, sets and minifigures has been offline since about 5 Nov 2026. LEGO says it took the site down after finding unusual activity and is investigating. It has not confirmed a hack or said whether customer data was affected. The planned date to come back (11 Nov) has been removed. Sellers cannot reach storefronts, orders or profiles. One customer got repeated payment links for a preorder she had already paid for; LEGO says it knows of no wider payment issue, and no link to the incident is known. BrickLink had a credential-stuffing shutdown in Nov 2023.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BrickLink affected all accounts fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says LEGO has 'not confirmed a hack' and is investigating, and that no link between the payment links and the incident is known, so neither the entry method nor the route to users is stated.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#unknown

## How to check

Unexpected emails or texts about BrickLink: restoring access, confirming payment details, an urgent account problem, or payment links for orders. Sender domains and subject lines: unknown, none published yet. A real BrickLink notice will not need you to pay or enter your card through a link while the site is down.

## Fix

Do not click links in unexpected BrickLink payment or account messages. Check orders only through the official site once it is back. If you used your BrickLink password anywhere else, change it there now. Change your BrickLink password when the site returns. Sellers: tell buyers that payment requests do not come by surprise links.

## Timeline

- 2026-11-12T14:54:50+00:00 analyst

## Documents

- [describes] Malwarebytes Labs: LEGO’s BrickLink taken offline: What users should know https://www.malwarebytes.com/blog/news/2026/11/legos-bricklink-taken-offline-after-unusual-activity-what-users-should-know

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_