BrickLink offline: Lego says 'unusual activity' forced it to shut the marketplace

BrickLink, the Lego Group's online marketplace for second-hand bricks, sets and minifigures, has been offline since 5 November 2026, and on 11 November 2026 the company gave its first explanation: it pulled the site down itself after "identifying unusual activity on the platform". The notice on BrickLink's holding page gives no date for the site's return.

That leaves thousands of independent sellers unable to trade a week into the outage, and buyers with open orders unable to reach the site. Lego has not said what the unusual activity was, whether anyone gained unauthorised access, or whether any member data is affected.

What has Lego said about the BrickLink outage?

The only official account is the short statement on the holding page, marked "Updated: 11th November 2026". It reads, in part: "We took BrickLink offline after identifying unusual activity on the platform. Our immediate priority was to secure the site, protect our members and ensure the integrity of BrickLink."

The statement goes on to say that before the site comes back the company needs "to fully understand what has happened", which it describes as containing the issue, investigating how it happened and checking for related issues. It says that work is "still on-going".

Three things are missing from the statement:

• any description of what the unusual activity was
• any word on whether accounts, payment details or personal data were accessed
• any estimated time for the site to return

Until Lego says more, those are open questions rather than facts.

How did the outage unfold?

The timeline below is drawn from the holding page itself and from the Lego news site StoneWars, which tracked each change to the notice.

Date	What happened
Thursday 5 November 2026	BrickLink becomes unreachable late in the evening
Friday 6 November 2026	A new holding page says the outage is expected to last until Monday 9 November
Tuesday 10 November 2026	The notice now says the site will stay unavailable "until at least" 18:00 CET on Wednesday 11 November
Wednesday 11 November 2026	That time passes; the notice is replaced with the "unusual activity" statement and no return date
Thursday 12 November 2026	The site is still down, according to Euronews

So for most of the first week, members were given return times that came and went, without a reason for the closure. The explanation arrived only after the second of those times had been missed.

Has BrickLink been hacked?

Lego has not said so. The statement uses the phrase "unusual activity" and nothing stronger. The Brick Fan, a long-running Lego news site, noted that a cyberattack is being speculated about but that "there's no confirmation of that".

Some fan sites have read the wording as a sign of unauthorised access. That is their interpretation, not the company's, and we are not treating it as established. Lego has not named a cause, and no source we could open identifies anyone as responsible.

Why does this matter beyond Lego fans?

BrickLink is not a small hobby forum. When the Lego Group announced it was buying the business on 26 November 2019, it described a marketplace with "more than one million members" and "more than 10,000 stores from 70 countries". The site was founded in 2000 by Dan Jezek, and Euronews describes it as the "eBay of LEGO".

With the site down, those stores cannot take orders through it. The Brick Fan reports that some sellers have "flocked over to BrickOwl or eBay to sell inventory in the meantime".

Buyers are affected too. Anyone who placed an order just before 5 November cannot check it on the site until it returns.

What should BrickLink users do now?

The holding page carries no instructions for members, so there is no official checklist. The one piece of outside advice in the coverage so far comes from Xavier Bellekens, chief executive of the security firm Lupovis, who told Euronews that users should be wary of emails claiming to come from BrickLink, particularly ones asking them to reset a password, verify payment details or move to another marketplace.

He called taking the platform offline "a sensible precaution", while noting that each extra day of downtime hurts the businesses that rely on it.

That caution holds whatever the cause turns out to be. The genuine status update is the one on BrickLink's own holding page.

Has this happened before?

Yes, and the wording is familiar. In November 2023 BrickLink was also closed for several days. At the time the company said it had "temporarily closed the BrickLink site due to unusual activity", as Hackread reported. On 6 November 2023 it then said that "a very small percentage of our accounts may potentially have been accessed by unauthorized individuals".

That history does not tell us what has happened this time. Nothing in Lego's 2026 statement links the two events.

Analysis: the silence is costing more than the outage

This section is our own analysis.

Taking a marketplace offline while an investigation runs is a defensible decision. What is harder to defend is the communication. For six days the holding page offered return times, two of which were missed, before any reason was given.

For sellers who depend on the platform, that matters. A seller who knows the site is down for an open-ended investigation can make plans: list stock elsewhere, tell customers, pause purchases. A seller who is told "back on Monday", then "back on Wednesday", cannot.

There is also a trust question that Lego will need to answer when the site returns. Members will want to know plainly whether their accounts were touched and what has been changed. In 2023 the company did say, three days into that closure, that some accounts may have been accessed. A week into this one, members have less to go on.

It is a reminder that security is not only about the strength of the technology, a point that also runs through our report on what a formal proof of the Signal protocol does and does not cover. How an organisation communicates when something looks wrong is part of the picture.

Sources

• BrickLink holding page: statement updated 11 November 2026
• Euronews: LEGO shop BrickLink downed by 'unusual activity' on its website
• StoneWars: BrickLink Continues to Be Offline: First Statement on the Reasons
• The Brick Fan: BrickLink Issues Statement on Extended Downtime
• The LEGO Group: acquisition of BrickLink, 26 November 2019
• Hackread: LEGO Marketplace BrickLink Hacked? Website Down After Suspected Cyberattack (November 2023)