BrickLink is back. After about seven days offline, the LEGO-owned marketplace for second-hand sets and bricks returned to service on 12 November 2026, and LEGO has now confirmed what many sellers suspected while the site was dark: an unauthorised party got into member data. Our own check on 14 November found bricklink.com live again, not the holding page that had greeted visitors.
The confirmation is in BrickLink’s Community Update: its investigation confirmed that some usernames and IP addresses were accessed, and a very small number of email addresses too. A message to members, quoted by Brick Fanatics, called it a cyber incident. The email says some account information was accessed and disclosed by an unauthorised party; the affected information “may include” usernames and IP addresses. LEGO has given no count of affected members and has named no attacker and no method.
What LEGO confirmed was taken, and what was not
Passwords and payment information were not accessed, according to the company’s Community Update, published on 12 November and reported by The Brick Fan. The member email put it in plainer terms: a password, a postal address and financial information were not disclosed. Members whose usernames or emails were accessed have already been emailed, and need take no action.
BrickLink also said it found no evidence that orders, wanted lists, messages or store inventories were lost or changed. That matters because a wanted list or an order history is a record of deals in progress. The company added that it had addressed the issue found and would keep monitoring.
Two things remain unfinished. The Studio Forum, the discussion board for the free BrickLink Studio app, stays offline, with more information promised. And sellers get a gesture rather than compensation: BrickLink will waive seller fees for November and December 2026.
Seven days, hour by hour
| When | What happened |
|---|---|
| Late 5 Nov / 6 Nov | BrickLink goes offline; holding page calls it “necessary work” |
| Fri 6 Nov | Return promised for Friday evening, then pushed to Mon 9 Nov; interim message: “We’re Working on It: System Recovery Underway” |
| Mon 9 Nov | Return pushed again, to Wed 11 Nov, 18:00 CET |
| 11 Nov | Holding page says down “until at least 18:00 CET” Wednesday; message then replaced by an unusual-activity statement, no new return date |
| 11 Nov, shortly before 18:00 CET | Brickset posts LEGO’s statement, saying only that BrickLink had been taken offline after unusual activity |
| 11 Nov | BBC publishes; LEGO gives no cause, no breach answer, no date |
| 12 Nov | Site is back; Community Update confirms the access |
| 12 Nov, 20:55 | Brickset: “A week after BrickLink was taken offline, the website is back” |
| 13 Nov | The Register updates with the return and confirmation |
| 14 Nov | Our own check finds bricklink.com live again, resolving to the main page |
The deadline stands out. LEGO’s holding page had promised a return by Wednesday evening, 11 November, at 18:00 CET, saying the site would be down “until at least” that time. That message was then replaced, with no new timeframe given. Brickset posted LEGO’s new statement shortly before 18:00 CET, saying only that BrickLink had been taken offline after unusual activity. LEGO published the update after being contacted by the BBC. At that point LEGO had still not said whether the site had been breached or hacked, or whether customer data was affected. The confirmation that data had been accessed came a day later, in the Community Update.
BrickLink was set up by a fan and acquired by LEGO in 2019, according to the BBC. While it was down, the whole marketplace was out: stores, profiles and order history, wanted lists, the catalog and the Designer Program pages, per Rainbow Bricks and BrickUltra. The Studio building app still opened during the outage, but warned that its backend services were having problems, so the gallery, uploads and part prices could not be trusted. Sellers reported dramatic drops in revenue, and some switched to Brick Owl, itself offline for a few hours on 11 November for maintenance, Brick Fanatics reported.
How big is a week offline for BrickLink?
Seven days is longer than BrickLink’s last full outage. In March 2022, BrickLink restricted certain cross-border transactions after a cyber incident at a platform partner; LEGO said no BrickLink data was compromised, and normal service resumed shortly afterwards. In November 2023, it was offline five days, 3 to 8 November, after unusual activity, a ransom demand and credential stuffing; a very small percentage of accounts may have been accessed, and BrickLink said there was no evidence that its own systems had been compromised. The 2026 outage ran about seven days, from late 5 or 6 November to 12 November, about 1.4 times the 2023 outage, into the pre-Christmas selling peak.
TechReview analysis: the scale of the disruption can be put in one number, with its source clearly labelled. Brick-Tracker, a third-party tracker cited by BrickReport, counted about 18,750 stores on BrickLink, claimed, not confirmed by LEGO. Multiply it by seven days offline and the result is roughly 131,000 store-days of lost selling.
The fee waiver tells the same story. Two months of waived fees for a seven-day outage works out at roughly eight to nine times the outage. Waiving December as well shows how seriously LEGO took the seller disruption.
LEGO’s language moved in three steps: necessary work on the holding page, unusual activity in the 11 November statement, and a cyber incident in the message to members, while the Community Update confirmed the unauthorised access without using that phrase. What did not change: no attacker named, no method explained, no victim count given, and the Studio Forum still offline.
What members should check now
BrickLink says members need take no action, and with passwords and payment information untouched there is no forced reset. Still, a week offline leaves things to check.
- Check your inbox for BrickLink’s email to affected members and read what it says about your account.
- Open your order history, wanted lists and messages and confirm nothing is missing or changed.
- If you sell, check your store inventory and confirm listings and stock match what you left.
- Treat any payment link about a BrickLink order with suspicion until verified inside your account.
One case shows why the last step matters. Melanie Hoskin, a cybersecurity professional and LEGO collector for 45 years, told the BBC she received multiple payment links for a limited-edition release she had already paid for. LEGO at first did not believe the payment had been taken, and said it would ban her. The problem is now resolved, LEGO said it was not aware of wider payment issues, and the BBC states that it is unclear whether the glitch was connected. Separately, Brick Fanatics reported on 13 November that one reader said their partner had received a seemingly genuine email from the LEGO Group about a cancelled 2025 LEGO.com order, with a real order number, price, name and address. That is one reader’s report about a LEGO.com order, not a BrickLink order. This remains a single reader-reported account. LEGO has not independently confirmed the email’s authenticity or linked it to the BrickLink incident, so treat it as unverified. The safe habit stands either way: verify payment requests inside your account, never through a link in a message.
What to watch next
The Studio Forum is the most visible loose end. BrickLink said it would remain offline, so its return, or a longer silence, will show whether the incident is fully closed. The second is whether sellers report problems after restoration.
The bigger questions LEGO has not answered: who was responsible, how it happened, and how many members were affected. A victim count in particular would change how the story is judged. Until then, the facts are narrow but confirmed: BrickLink went dark for about seven days, came back on 12 November, and LEGO has confirmed that some usernames, IP addresses and a very small number of emails were accessed, while passwords and payment information were not. The sellers got two months of waived fees for a week of silence, and the forum is still offline. For a different kind of exposure, see the Wyndham app case.
