Beckett Collectibles Faces Class Action Lawsuit Over 2025 Data Breach Affecting 1 Million Accounts
A proposed class action lawsuit has been filed against Beckett Collectibles and Beckett Authentication Services, alleging negligence in protecting customer data following a November 2025 breach that exposed personal information from approximately one million accounts. The complaint, filed on August 5 in the U.S. District Court for the District of New Mexico by plaintiff Douglas Larson, accuses Beckett of failing to secure sensitive data and withholding details about the incident’s scope.
The breach first came to light in November 2025 when cybersecurity firm Value Added Resource reported that stolen Beckett data was being sold on a hacking forum, alongside evidence of website defacement. Screenshots of the leaked records revealed names, email addresses, phone numbers, and billing and shipping details. Despite the reports, Beckett did not publicly acknowledge the breach or notify affected customers.
Have I Been Pwned later confirmed the breach, initially listing over 500,000 compromised email addresses tied to North American users. A second data dump in December 2025 expanded the count to more than one million, including usernames, physical addresses, and additional contact information.
Larson, a New Mexico resident, alleges his Gmail address provided to Beckett during a 2021 authentication service for a Pink Floyd-signed guitar was among the exposed data. He claims the breach led to a surge in spam and phishing attempts, as well as an April 2026 attack on his website’s payment system, which disrupted transactions and forced a switch from Stripe to PayPal. While Larson does not directly link the breach to the payment fraud, he argues that discovery may establish a connection.
The lawsuit criticizes Beckett for retaining outdated customer records, failing to detect the intrusion promptly, and neglecting to implement adequate security measures. Beckett, now owned by Collectors (parent company of PSA and SGC), was acquired in December 2025, after the breach occurred. Neither Collectors nor PSA is named as a defendant.
The complaint seeks damages for privacy violations, fraud, business disruption, and other harms, while demanding Beckett disclose the full extent of the breach, improve security protocols, and purge unnecessary customer data. The case also raises potential disputes over arbitration clauses in Beckett’s terms of service, which Larson argues do not apply to his 2021 transaction.
Beckett has not yet responded in court, and the allegations remain unproven. The lawsuit could provide the first official account of the breach’s origins, affected systems, and the company’s data retention practices. The case is Larson v. Beckett Collectibles, LLC et al., Case No. 1:26-cv-02563.
Source: https://www.valueaddedresource.net/beckett-class-action-2025-data-breach/
Beckett Authentication Services TPRM report: https://www.rankiteo.com/company/beckett-collectibles
Beckett Collectibles TPRM report: https://www.rankiteo.com/company/beckett-collectibles
"id": "bec1786062242",
"linkid": "beckett-collectibles",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '1,000,000',
'industry': 'Collectibles Authentication and Grading',
'location': 'United States',
'name': 'Beckett Collectibles, LLC',
'type': 'Company'}],
'attack_vector': 'Unknown',
'data_breach': {'data_exfiltration': 'Yes (data sold on hacking forum)',
'number_of_records_exposed': '1,000,000+',
'personally_identifiable_information': 'Names, email '
'addresses, phone '
'numbers, physical '
'addresses, usernames',
'sensitivity_of_data': 'High (PII, financial-related data)',
'type_of_data_compromised': ['Personal Identifiable '
'Information (PII)',
'Billing and shipping details',
'Contact information']},
'date_detected': '2025-11',
'description': 'A proposed class action lawsuit has been filed against '
'Beckett Collectibles and Beckett Authentication Services, '
'alleging negligence in protecting customer data following a '
'November 2025 breach that exposed personal information from '
'approximately one million accounts. The breach was first '
'reported when stolen data was found being sold on a hacking '
'forum, alongside evidence of website defacement. The lawsuit '
'seeks damages for privacy violations, fraud, business '
'disruption, and other harms, while demanding improved '
"security protocols and disclosure of the breach's full "
'extent.',
'impact': {'brand_reputation_impact': 'Negative (allegations of negligence, '
'delayed disclosure)',
'data_compromised': 'Names, email addresses, phone numbers, '
'billing and shipping details, usernames, '
'physical addresses',
'identity_theft_risk': 'High (PII exposed)',
'legal_liabilities': 'Class action lawsuit filed, potential '
'regulatory fines',
'operational_impact': "Disruption to payment systems (plaintiff's "
'website), increased spam/phishing attempts',
'payment_information_risk': 'Possible (billing details exposed)',
'systems_affected': 'Customer database, website (defacement)'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing (lawsuit pending)',
'motivation': 'Financial Gain (Data Sold on Dark Web)',
'post_incident_analysis': {'root_causes': 'Alleged negligence in data '
'security, retention of outdated '
'customer records, delayed '
'detection of intrusion'},
'recommendations': ['Improve security protocols',
'Disclose full extent of the breach',
'Purge unnecessary customer data',
'Enhance monitoring and detection capabilities'],
'references': [{'source': 'U.S. District Court for the District of New '
'Mexico'},
{'source': 'Have I Been Pwned',
'url': 'https://haveibeenpwned.com'},
{'source': 'Cybersecurity firm *Value Added Resource*'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit filed '
'(*Larson v. Beckett Collectibles, '
'LLC et al.*, Case No. '
'1:26-cv-02563)',
'regulations_violated': ['Potential violations of '
'data protection laws '
'(e.g., state-level breach '
'notification laws)']},
'response': {'communication_strategy': 'No public acknowledgment or customer '
'notifications initially',
'third_party_assistance': 'Cybersecurity firm *Value Added '
'Resource* reported the breach'},
'title': 'Beckett Collectibles Data Breach and Class Action Lawsuit',
'type': 'Data Breach'}