Beckett Collectibles

We noticed a significant influx of user data originating from Beckett Collectibles appearing on a prominent dark web forum in early November 2025. What struck us immediately was the sheer volume of records, exceeding one million unique email addresses, coupled with a comprehensive set of personally identifiable information (PII). The timing of this leak, coinciding with a period of increased online activity for collectors engaging in seasonal trading, amplifies the potential impact. The inclusion of not just basic contact details but also business names and physical addresses suggests a sophisticated level of reconnaissance or a direct compromise of a customer database.

The breach, discovered on November 8th, 2025, involved an estimated 1,027,900 records from Beckett Collectibles, a US-based service catering to the trading card and collectibles market. The exposed data encompasses a range of sensitive PII, including email addresses, phone numbers, usernames, first names, and last names. Notably, the dataset also contains business names and physical addresses, indicating a deeper compromise than a simple credential stuffing attack might suggest. The data was subsequently disseminated on a well-known hacking forum, a common tactic for threat actors seeking to monetize stolen information or gain notoriety. The source structure points to a direct database exfiltration, rather than a web application vulnerability, implying a compromise of the backend infrastructure.

While this specific incident has not yet garnered widespread mainstream media attention, the pattern of data leaks from e-commerce and hobbyist platforms is a recurring theme in cybersecurity news. Similar breaches of collector-focused sites have been documented, often leading to subsequent phishing campaigns and identity theft. OSINT analysis of the forum where the data was released shows discussions around potential resale of the Beckett Collectibles dataset, highlighting the immediate financial incentive for threat actors. Further research into similar database compromises within the collectibles industry may reveal common attack vectors and threat actor methodologies.