Lego Takes BrickLink Offline Again After Unusual Activity
Lego has taken BrickLink, the online marketplace where fans buy and sell Lego parts and sets, offline after identifying unusual activity on the platform. At the time of The Verge's reporting, the site had been unavailable for a week.
The official site now displays a notice titled “BrickLink is temporarily unavailable.” According to BrickLink's own outage notice, the page was updated on 11 November 2026. The site had last been expected to return on November 11. Lego has given no current estimate for when it will come back.
Lego's stated priority is to secure the site, protect members and ensure the integrity of BrickLink. The company says that before restoring service it must contain the problem, investigate how it happened and check for related issues. That sequence ties the return to completed containment and review rather than to a calendar date.
The outage is not the first of its kind for the platform. Lego bought BrickLink in 2019. Around the same time of year three years earlier, BrickLink was offline for several days because of a cybersecurity incident. In that case Lego shut the site down out of an abundance of caution after receiving a threat and a ransom demand, meaning a payment request tied to a threatened attack. When BrickLink returned, users were prompted to change their passwords under stronger requirements, and they were assured their accounts had not been compromised.
The broader context here is a platform whose user base is built on trust between individual sellers and buyers, many of them hobbyists who maintain long-running inventories and wish lists. A marketplace like that depends on account security as much as on uptime, the share of time a service is actually reachable. That is probably why the earlier response centred on credential hygiene, meaning good password practice. Whether the current activity follows a similar pattern is not something the public record yet establishes, and the company has not tied its restoration to any timeline.
In my view, the most useful thing to watch over the coming days is not the return date itself but what accompanies it. If Lego follows the path it took after the earlier incident, a return would likely come with visible authentication changes and a clear statement about account status. Those are the signals that would show the containment and investigation steps it has described have produced concrete results. For a community that relies on the site to source parts and complete sets, the wait is an inconvenience. For the operator, it is a test of whether a second recovery in three years can be run with the same discipline as the first.
Marketplaces of this kind have a long track record of recovering from security events, provided operators are willing to take them offline and rebuild trust in public. The sequence Lego has described, containment first and only then restoration, is the conventional one, and it leaves room for a proper investigation. The open questions are how long that takes and what the company finds.
