BrickLink, the Lego-owned marketplace, is back in operation after a data breach, and the company says the damage stopped short of passwords and payment information.
The company confirmed that attackers accessed usernames, IP addresses and a small number of email addresses. It said passwords and payment details were not accessed. BrickLink is a marketplace where Lego fans buy and sell sets and parts, so the affected data comes from buyers and sellers rather than a general retail audience.
The split matters. Passwords and card numbers are what let an attacker take over an account or spend someone's money, and by the company's account neither was exposed. What was exposed is thinner but not harmless. A username tied to an IP address (the numeric address that roughly indicates where a connection originates) links a marketplace identity to a rough location. An email address gives a scammer a way to reach that person.
The realistic risk is phishing. A message that mentions a real BrickLink username and looks like an order notice or an account warning is more convincing than a generic one. Because the company says passwords were not taken, a forced reset is less urgent than caution with unexpected messages that claim to come from the marketplace.
Several questions remain open: how many accounts were affected, how the attackers got in, and how long the data was accessible. The phrase "a small number of email addresses" is also odd next to the broader category of usernames and IP addresses. It suggests the three data types were not exposed in equal volume, and the company has not said what the proportions were.