Last night we reported that the LEGO Shop was hacked to promote a crypto scam and LEGO today has released a statement to Engadget about it. They did confirm that there was an unauthorized banner (shown above) and they have identified the cause of why it happened and are implementing measures to prevent it from happening again. Everything should be back to normal now and no user accounts were affected but I suggest changing your password anyways and using the two-factor authentication.

“On 5 October 2024 (October 4 evening in the US), an unauthorised banner briefly appeared on LEGO.com. It was quickly removed, and the issue has been resolved. No user accounts have been compromised, and customers can continue shopping as usual. The cause has been identified and we are implementing measures to prevent this from happening again.”

It looks like the LEGO Shop has been hacked and is hit with a crypto scam. If you are shopping, I would be very wary and keep a close eye on your bank accounts. The scam is in the banner when you hit the main page and it changes to the normal one with the Jabba’s Sail Barge a few seconds later.

If you happen to click on the links, it goes to a marketplace where they are selling “LEGO Tokens” with ETH. I would not buy or sell any of it as LEGO doesn’t do crypto. Thanks to ZTBricks for the heads up.

Update: It looks like the site has been fixed. Good on them to get it done quickly but we’ll see if there was any damage done.