Beckett's rebuild looks like recovery, not a plan

Every company has a bad week. What separates a bad week from a bad sign is whether the response matches the explanation, and eleven days in, Beckett's does not.

What the site is right now

Type beckett.com into a browser and you are redirected to maintenance.beckett.com, a single page with no database behind it, served out of Amazon S3. That is object storage. It is where you put files when you have nowhere else to put them, and it is a sensible choice for a page that has to stay up when nothing else will.

Earlier in the outage they were not even hiding it. The holding page answered at the bucket's own address, which is the sort of detail that only shows up when a page goes live in a hurry.

Everything a customer needs now runs on somebody else's software. Submissions go through JotForm, a form builder. Customer service goes through a HubSpot form. Neither has been dressed up to look like Beckett: the links go to jotform.com and hsforms.com in plain sight, because putting your own name on a rented service takes configuration time nobody had.

Still dark: accounts, the population report, the price guide, the marketplace, the mobile app, EU submissions, and the certificate lookup. The reason given on 9 September has not changed since. Beckett is upgrading its digital infrastructure.

This is the shape of a recovery

Planned work has an end. This has run eleven days without a restoration date, and status.beckett.com, where a company would normally post one, does not resolve at all. There is no status page to be late on.

Planned work is also sequenced. When a team moves a system on purpose, the read-only parts stay up, because they are the easiest to keep running and the most people depend on them. A price guide is a list. A population report is a count. A certificate lookup is a database and a search box. Those are the three things that should have survived a migration, and they are the three things that have been down the longest.

And planned work does not move customer service to another company's domain. Support tooling is the thing you keep when you are moving everything else, because it is how people tell you the move went wrong.

Put those together and you get the standard shape of a recovery: a page that cannot fail, rented forms to keep revenue moving, and support pointed at whatever still works. It is a competent emergency response. It is not a migration, and calling it one for eleven days is the part that invites the questions the company says it does not want.

The scale makes it harder to explain rather than easier. Beckett is owned by Collectors, which also owns PSA and SGC and has had no comparable outage on either. Whatever is broken is specific to Beckett's own systems, and money and engineers are not the constraint inside that group. A company that simply wanted a modern holding page, a submission flow and a support channel could have had all three on its own infrastructure in a couple of days. Eleven days of rented parts says the problem was never building something new. It is getting back what was already there.

There is no privacy policy on the internet right now

This deserves its own heading, because it is the part nobody is talking about. Type beckett.com/privacy into a browser and you land on the holding page. The same is true of /privacy-policy, /terms and /terms-of-use. Every document describing what Beckett does with your information has been unreachable for eleven days.

That is not a technicality. A privacy policy is the only place a company tells you which third parties process your data, how long it is kept, what it may be used for, and how to ask for it back. Beckett is a business that holds names, addresses, phone numbers, payment history and grading records for a very large number of collectors, and at the moment it publishes none of that.

It matters more, not less, because collecting has continued throughout. Beckett has been taking personal information into rented systems for eleven days with no published statement governing any of it, and an existing customer who wanted to exercise a right — see what is held, have it deleted — would find the page describing how to do that redirects to a notice about infrastructure enhancements.

What you are actually handing over

To submit a card you fill in your name, your street address, your city, state, ZIP and country, your email, the declared value of each card, and then you sign it. An actual signature, drawn with a mouse or a finger, captured by a JavaScript widget on a third-party form.

That form also asks you to accept terms. They are not linked, because the pages they live on are down. They are pasted into the form as text, and they are not grading terms — they are the website's membership terms, including consent to marketing text messages, complete with a STOP keyword and a support number. A grading submission is carrying a marketing opt-in.

So: your address and your signature go into JotForm's systems, your support messages into HubSpot's, under agreements between those companies and Beckett that you cannot see, governed by a policy you cannot read, with no stated retention period and no working route to ask for deletion. Each of those services is perfectly reputable. That is not the point. The point is that nobody has told you they are involved, or on what terms.

Our position: do not send Beckett cards right now

This site does not tell people what to buy, and it is not going to start. What follows is a recommendation about risk, not about value, and it is ours rather than a finding of fact.

Until Beckett publishes a restoration date and states plainly whether customer data was involved in this outage, we would not send it cards, and we would not put personal details through the temporary form.

The reasons are the verifiable ones, not the speculative one. A grading order is a contract you cannot read the terms of, because the terms are down. It hands personal data and a signature to processors nobody has disclosed, under a privacy policy nobody can see. It goes to a company that has missed two stated timelines in a row and has given no third one. And it buys a slab whose certificate cannot currently be verified by you or by the person you eventually sell to — which is most of what you are paying for.

Cards already in the building are a different question. Those are moving, and pulling them is not obviously better than waiting.

This is a temporary position, and we will say so plainly when it changes. A restoration date and a clear statement about data would end it, probably in a single paragraph from the company.

So was it a breach?

That is the question under every thread about this, so here it is plainly. We do not know, and nobody outside the company does.

The conduct is consistent with a security incident. The scope is total across systems that do not share much. There is no end date. There is no status page. Everything customer-facing has been rebuilt on rented tools rather than restored. And the silence has held for eleven days while the certificate record of every BGS slab in the market stays unverifiable.

It is also consistent with a failed migration, a database that came back wrong, or a vendor or hosting relationship that ended badly. Those are ordinary disasters, and from the outside they look exactly like this.

What we have not found matters too, and we looked: no breach notification in any state registry, no regulatory filing, no disclosure from the parent company, and no credible report of Beckett data circulating anywhere. Absent those, a breach is a hypothesis, not a finding, and we are not going to dress it up as one.

So treat it as a hypothesis, and watch what would settle it. A breach notification or a statement naming customer data would answer it one way. A restoration that brings back accounts, order history and the certificate database intact, with an explanation that fits eleven days, would answer it the other.

What ends this

A date, and a sentence about data. That is all.

Beckett holds two things that are not really its own: collector accounts, and the certificate record that lets a stranger check a slab. A company holding both owes the people relying on them a restoration date and a plain statement about whether their information was involved. Eleven days of infrastructure enhancements is neither, and the silence is doing more damage to Beckett's name than the outage is.