  
| Author: | Admin_Russell  | | Posted: | Nov 8, 2023 13:07 | | Subject: | Update on November 3rd incident | | Viewed: | 5275 times | | Topic: | Administrative | |
|
|
BrickLink
ID CardAdmin_Russell
|
Location:  USA, California |
| Member Since |
Contact |
Type |
Status |
| May 9, 2017 |
 |
Admin |
|
|
| BrickLink Administrator |
|
| Dear BrickLink members,
Welcome back and thank you for your patience. We were down for longer than anyone
would have wanted. Now that we’re back up and running, we can share with you
what’s happened.
As many of you will know, we received a threat and ransom demand on Friday, November
3rd. We’d been aware of and actively managing some limited suspicious activity
since mid-October, with unauthorized sellers offering products at huge discounts
and fraudulently accepting payment from buyers.
As soon as we were aware of the potential escalation on November 3rd, we put
the site into maintenance mode out of an abundance of caution. We did this to
protect our members and keep complete control of the platform while investigating.
We found that a relatively small number of BrickLink accounts may have been accessed.
It is important to note that there is no evidence so far that our systems were
compromised.
At this stage we believe this was a ‘credential stuffing’ incident, where
someone obtains lists of usernames and passwords from a third party, often illegally,
and opportunistically tries to use them on a website.
Actions we’ve taken
Although we know that the BrickLink site was not breached, we've further
strengthened our security. We take the safety of BrickLink and our members very
seriously and will continue to step up security across the platform.
We’ve informed people where we have reason to believe that their accounts or
stores may have been impacted, and reminded members of ways they can make their
accounts safer and more secure by practicing good data security. Keep your systems
up-to-date with the latest patches, Use security software and create strong,
unique passwords for each website you use.
Again, we’re sorry for the interruption and inconvenience this has caused you.
If you have any questions or concerns, have a look at the FAQ for more details,
or reach out to customersupport@bricklink.com.
Many thanks,
Your BrickLink Team
|
|
Message Has 123 Replies:  Re: Update on November 3rd incident - TheBrickGuys (13286) | [...] Thanks for working to get us back up and running quickly. It was surprising just how much we depend on BrickLink, I felt literally lost at times without it so thanks [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - Rob_and_Shelagh (26339) | Dear Bricklink team, Thanks to all who worked hard to restore the site and continue to support our activities here, we really appreciate it! Best regards, Robert & Shelagh [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - BubbaVonBraun (55) | Folks, Kudos on handling this so well. As an IT professional I have worked a number of these incidents. Security incidents will happen, its how the company responds to it that [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - Give.Me.A.Brick (10611) | A huge THANK YOU Russell and everyone on the BrickLink Team! We are very grateful for all the hard work and sleepless nights you all have put to safely reopen this much missed [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - jodawill (139) | [...] Thank you for doing your due diligence. I'm grateful you decided to take the site offline so you could do a proper incident response. Is there any chance we could [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - CE_Tanja | Thank you for all your kind thoughts! For good reason we are currently experiencing a very high load on our systems due to seller activity. We understand that everyone is keen [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - CE_Tanja | We are seeing a high number of Helpdesk tickets related to entering the site due to added security measures. We will be looking in to these, just giving everyone impacted a heads [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - Michaeld1983 (1868) | Thanks team for getting everything back up. You have handled this situation with care and speed. I appreciate your efforts and fortunately my store (and inventory) remain [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - chriselliottart (563) | Thank you for all your hard work to ensure the site's safety and continuity. These things happen and I hope the team is getting some well-deserved rest soon! In Administrative, [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - srawrats (18) | Thank you very very much for your great work! I can imagine, how hard your days and nights were, I'm fighting also nearly every day against cyber crime etc. coming from outside [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - R0Sch (46) | Thanks for the efforts to bring back the site up and running again. It's better not rushing things when it comes to security. Hope LEGO can introduces 2FA and longer passwords [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - tvattima (452) | [...] Bricklink Team, as a software developer at a major financial institution, I can empathize with this critical situation and the very long days the team must have put in [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - KACL (45) | [...] Thank you so much for all of your hard work and dedication to the BL community. I really appreciated being kept in the loop while this was all going on. We really do [...]
(6 months ago, Nov 8, 2023, to Administrative) |
Re: Update on November 3rd incident - Prescribed_Brix (734) | Thanks for getting the site open to all again, but I do still have to complain about the lack of communication and dearth of information posted on the only accessible page. [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - Shellfish_Sam (30) | [...] Appreciate your quick response and bold actions to resolve. A few days of downtime isn't that big of a deal in the long run. This is an awesome site, and hate [...]
(6 months ago, Nov 8, 2023, to Administrative) |
| Re: Update on November 3rd incident - dursagon (44) | [...] Thanks for your efforts. Those who don't know how situations like this are played out in the tech support industry will always whine about how long it took because [...]
(6 months ago, Nov 9, 2023, to Administrative) |
| Re: Update on November 3rd incident - Nessiah (365) | [...] ... [...] Now at the latest would be the time for mandatory 2FA for all members, something that has long been called for and can ensure the security of accounts. Otherwise: [...]
(6 months ago, Nov 9, 2023, to Administrative) |
| Re: Update on November 3rd incident - lostcarpark (232) | Well done on taking decisive action, and getting the site back to normal quickly. I think getting users to reset passwords is a wise precaution. I have two suggestions. There [...]
(6 months ago, Nov 9, 2023, to Administrative) |
| Re: Update on November 3rd incident - rtjepsen (1897) | Very happy to see the site back up again. While it did take quite a while to work through, I felt it was necessary to conduct a thorough check of the system for any virus, Trojan [...]
(6 months ago, Nov 9, 2023, to Administrative) |
| Re: Update on November 3rd incident - TrevithickLego (443) | Dear Bricklink team and Admins, thank you very much for the great work and your efforts after the terrible disaster on Friday. Personally, I no longer believed that Bricklink [...]
(6 months ago, Nov 9, 2023, to Administrative) |
| Re: Update on November 3rd incident - a67sm (52) | Thank you! Please do prioritize 2FA and a real secure implementation, not just the email or phone number verification but a cryptographically generated OTP option, and preferable [...]
(6 months ago, Nov 9, 2023, to Administrative) |
| Re: Update on November 3rd incident - stripes (733) | [...] As a long time Bricklink member, please for the love of god please please please prioritize two factor authentication. This is dumb for 2023, especially since Lego Corp [...]
(6 months ago, Nov 13, 2023, to Administrative) |
| change my name? - Darkhunter07 (438) | hello, hope you dont mind me asking a admin this but i would like to change my name but i get an error
(6 months ago, Nov 13, 2023, to Administrative) |
| Re: Update on November 3rd incident - brickpopz (0) | Was it checked that members emails and passwords (details) were accessed and potentially used for "credential stuffing" on other websites? Best Regards In Administrative, [...]
(6 months ago, Nov 15, 2023, to Administrative) |
Re: Update on November 3rd incident - Almere_Bricks (3802) | Please handle as promis feedback remove fast, waiting 4 days and no response on removal or ticked, how much damage we as store need to take before you guys help?? In Administrative, [...]
(6 months ago, Nov 19, 2023, to Administrative) |
| Re: Update on November 3rd incident - LegoMiniGuy (284) | Thanks for that update. I work on authentication flows for a very large tech company. One of the best things that Bricklink could do to improve security dramatically, while easing [...]
(6 months ago, Nov 22, 2023, to Administrative) |
| Re: Update on November 3rd incident - thebrickshow (3796) | So at what point to you reply to my emails asking if you are going to credit me for the $750 order I placed to a seller I thought was legit that your system did not protect me [...]
(6 months ago, Dec 3, 2023, to Administrative) |
| Re: Update on November 3rd incident - peeledpeas (9) | [...] The site keeps bugging me to update my password but I have already done that after the incident. It's a very strong password generated by Google. How can I stop [...]
(5 months ago, Dec 10, 2023, to Administrative) |
226 Messages in this Thread.
(Message tree supressed because there are more than 50 messages in this thread)
show message tree
Entire thread on one page
This message and all its replies on one page
|
