LEGO's BrickLink marketplace is back online after a week-long outage caused by what the company described as a "cyber incident," during which an unauthorized third party accessed some user data. Details about exactly what data was accessed remain unclear. The site went offline on November 5 and remained unavailable until November 12, preventing users from buying or selling LEGO sets and parts during the busy holiday shopping season. According to Brick Fanatics, LEGO initially described the outage as "necessary work" before confirming that the platform had suffered a security incident.
In an email to users, LEGO acknowledged that "some of the information associated with your account was accessed and disclosed by an unauthorized party," including potentially usernames and IP addresses. However, the company insisted that "your password, postal address, and financial information were not disclosed." Those assurances have since come under scrutiny following reports of convincing phishing emails containing detailed personal and purchase information.
The outage also dealt a significant blow to independent sellers who rely on BrickLink for income. Simon Webster, who operates stores on both BrickLink and rival marketplace Brick Owl, reported that his overall sales revenue fell 52% over a four-day period, even as sales through Brick Owl rose 79%. "Their comms are amateur at the best of times, but surely they should be able to send an email to let sellers and buyers alike know what is happening and what they're doing to rectify it," Webster said. "But no, we're all left in the dark."
The incident has renewed concerns about BrickLink's aging infrastructure. Founded in 2000 and acquired by LEGO in 2019, the marketplace reportedly runs on a complex collection of interconnected systems that makes modernization difficult. The Brick Fanatics report questions whether the 25-year-old platform remains fit for purpose and whether prolonged outages and security concerns could push sellers toward competing marketplaces like Brick Owl.
In an email to users, LEGO acknowledged that "some of the information associated with your account was accessed and disclosed by an unauthorized party," including potentially usernames and IP addresses. However, the company insisted that "your password, postal address, and financial information were not disclosed." Those assurances have since come under scrutiny following reports of convincing phishing emails containing detailed personal and purchase information.
The outage also dealt a significant blow to independent sellers who rely on BrickLink for income. Simon Webster, who operates stores on both BrickLink and rival marketplace Brick Owl, reported that his overall sales revenue fell 52% over a four-day period, even as sales through Brick Owl rose 79%. "Their comms are amateur at the best of times, but surely they should be able to send an email to let sellers and buyers alike know what is happening and what they're doing to rectify it," Webster said. "But no, we're all left in the dark."
The incident has renewed concerns about BrickLink's aging infrastructure. Founded in 2000 and acquired by LEGO in 2019, the marketplace reportedly runs on a complex collection of interconnected systems that makes modernization difficult. The Brick Fanatics report questions whether the 25-year-old platform remains fit for purpose and whether prolonged outages and security concerns could push sellers toward competing marketplaces like Brick Owl.
Read more of this story at Slashdot.
