LEGO Official Site Hacked By Crypto Scam

There was just one problem, though: the banner was not authorized by LEGO and was instead part of an elaborate LEGO hack that led users to an unaffiliated third-party cryptocurrency website.

The LEGO hack occurred at around 9 pm EDT on October 4, which meant that for the folks at LEGO global headquarters in Denmark, which sits in a time zone that is six hours ahead of the East Coast, the hack was an unfortunate early morning surprise.

The unauthorized access to LEGO’s company website didn’t completely alter the design or layout of the web page.

Instead, the hackers only replaced the preexisting Fortnite banner with what appears to be an AI generated image with an added link that directed users to the third-party website.

In what could have been a dead giveaway that the LEGO banner was part of a hack and laced with AI imagery, the LEGO figures featured in the ad did not have any of the traditional faces that LEGO fans have come to expect from the figures.

The hacked banner also retained the Fortnite title in the upper left hand corner of its image, suggesting that the hackers were possibly attempting to have their scheme fly under the radar for as along as possible before sounding any alarms.

Despite the hack’s inconvenient timing, LEGO resolved the matter in about an hour and restored the banner to its original design without much effort. Shortly after the incident, LEGO released an official statement to Engadget regarding the hack, ensuring its customers that there was no threat to any account or personal information and that the hack appeared to be an isolated cyber-attack.

“On 5 October 2024 (October 4 evening in the US), an unauthorized banner briefly appeared on LEGO.com,” the statement reads. “It was quickly removed, and the issue has been resolved. No user accounts have been compromised, and customers can continue shopping as usual. The cause has been identified and we are implementing measures to prevent this from happening again.”

While LEGO handled the hack in a quick and efficient manner, it still remains unclear how a third party was able to access the company’s website and whether or not any customers who were led to the second unauthorized site fell victim to purchasing any of the “LEGO Coins” that were briefly advertised.

While launching a cyber-attack on a toy company might seem like a low blow, this isn’t the first time that LEGO fans have faced a hack.

In November 2023, the Denmark-based company announced that the website BrickLink, a LEGO marketplace where fans can buy and sell used LEGO parts, fell victim to a coordinated cyber-attack from a third-party. The latter found a way to access the accounts of sellers on the marketplace. LEGO revealed that those responsible for the hack then demanded ransom.

The hack prompted LEGO to encourage users to change their passwords, revealing that accounts were compromised by attackers who had purchased account credentials elsewhere, ensuring that BrinkLink was secured for most users.

Source: Engadget