It took Beckett 23 days to say "suspicious". The rest of its statement is still vague.

Start with what changed. When Beckett took beckett.com, its other sites and its app offline on the evening of 9 September, it said it was upgrading its digital infrastructure. That explanation held for more than three weeks. On 2 October a Facebook post and a new Tech Updates page told a different story. During planned updates to its legacy systems, Beckett says, it "detected suspicious technical activity and, out of caution, took our platforms offline." Beckett puts the long outage down to "a thorough forensic investigation, including engaging leading security experts."

That is a security incident, described in Beckett's own words. By its own account, Beckett knew from the start. For 23 days it told customers something else, and all that time they kept typing their names, home addresses and signatures into a temporary submission form. On 20 September we wrote that the outage looked like recovery, not a planned upgrade, and that the question of a security incident was open. Beckett has now answered it, and its holding page answers it both ways. Under one tab is the forensic-investigation statement. Under another, the answer to "When will Beckett.com be back online?" still says the team is working to "complete the infrastructure enhancements."

Parts of the statement deserve credit. Beckett says the cards in its building are secure, and that certificate records, grade records and historical population data are "intact and uncompromised." Those claims matter most to the market, and Beckett makes them plainly. The restoration order is the right one. Certificate lookup and the population report come back in the first phase, with accounts and online submissions. Those are the tools that let someone who isn't a Beckett customer check a BGS slab, and they should never have been the last things standing dark. Beckett has also given Online Price Guide subscribers 60 extra days free. All of that is reasonable.

The wording on customer data is less clear. Beckett says the investigation "has not identified any evidence that sensitive customer information was impacted." Look at the qualifiers. "Has not identified any evidence" is not the same as "was not accessed." And "sensitive" is never defined. In US breach notices the word often means Social Security numbers, card numbers and bank details. It usually does not cover names, email addresses, phone numbers or home addresses, which are exactly what a grading customer hands over.

That distinction matters more at Beckett than at most companies. In August a collector filed a federal class action alleging that a November 2025 Beckett breach exposed about a million accounts, including names, emails, phone numbers and physical addresses. Beckett has never addressed those allegations in public. The plaintiff dropped the case on 11 September, two days after the site went dark. The new statement does not mention it. Customers deserve a plain answer to two questions. Could whoever was behind the suspicious activity reach names, addresses, contact details or password data? And is this connected to what was alleged last year?

Two other lines are unusual. Beckett says its "team maintains full access to our systems and data." Companies rarely volunteer that unless the question has come up. The statement also closes by recommending strong, unique passwords and two-factor authentication. If account data was untouched, that is generic advice. If it was not, Beckett owes customers who reused their Beckett password elsewhere a direct warning, not a reminder in the closing paragraph.

The timeline is no firmer than before. The three phases will arrive "over the coming weeks." No phase has a date, not even the first, which brings back certificate lookup. After 23 days, a restoration plan with no dates is a list of priorities, not a schedule.

Then there is the link. The Facebook post tells readers to visit beckett.com/techupdates for the latest updates. That address does not reach the statement. Beckett redirects every address on beckett.com to the front of its holding page. That page is titled "Express Submissions Remain Open", and it leads with a button to start a $79.95 Express submission. The statement sits at a different address, maintenance.beckett.com/techupdates. Add a trailing slash to that one and you get a bare Amazon access-denied error. Beckett announced a rebuild of its digital platforms with a link that misses the statement. It is a small thing. It is also the only part of the post a reader can check, and it does not work.

Saying "suspicious" is progress. Turning it into a disclosure takes four things: a plain list of what customer data was reachable, an answer on whether this is linked to last year's allegations, a date for each phase, and a link that works. Until the first phase is back, BGS certificate numbers still cannot be checked online. That is worth knowing before buying a BGS slab or sending in a submission.