Visitors to Lego.com on the evening of October 4 found that the homepage had changed. A banner featuring golden coins with the Lego logo promised users the "Lego coin" was available. The Lego website hack was done by crypto scammers trying to convince users that the company had launched its branded cryptocurrency.

The Scam

The hacked website falsely claimed that a "Lego coin" was now available for purchase, promising "secret rewards" to those who bought the crypto. Lego hadn't launched any cryptocurrency. It was a scam.

According to The Brick Fan, the button on the banner led users to an external cryptocurrency site selling so-called "LEGO Tokens" with Ethereum.

The banner was part of a larger scam, as the Lego website had been hijacked by bad actors overnight, targeting unsuspecting visitors.

Lego Website Hack Found by Reddit Users 

A Reddit user named "mescad" was quick to warn others about the hack. "Around 9 pm EDT we became aware that the Lego.com website was edited with a message about a 'new coin' and had links to a cryptocurrency website." 

He also urged users to avoid the site, adding, "Lego is not releasing cryptocurrency! This is a scam, and you should avoid it."

And suggested that users change their passwords as a precaution: "After the site is restored, I would suggest that you change your password. We do not have any information about whether or not user data has been compromised, but it's better to be safe."

Lego’s Response

Lego acted swiftly, removing the unauthorized banner and restoring its original content.

A company statement on October 5 assured customers that "No user accounts have been compromised, and customers can continue shopping as usual."

Lego added that it has identified the cause of the hack and is implementing measures to prevent future incidents, though it declined to share specific details about those measures.