Around 1500 UK charities have potentially suffered data breaches following a cyber incident impacting third-party CRM provider Beacon.
Personal details held by these charities, including those operating in sensitive areas such as healthcare and victim support, are believed to have been accessed, copied and likely exfiltrated by an unauthorized actor.
Beacon offers a specialized CRM platform to charities and holds data for around 1500 voluntary sector organizations.
In a statement sent to Infosecurity on August 6, a Beacon spokesperson revealed that the software provider has notified “all” its customers of the incident.
“Our focus is now on supporting them as much as possible in any onward communication of their own regarding potential data impact,” the spokesperson continued.
Since the incident was first publicly disclosed by Beacon on August 4, 2026, numerous UK-based charities have revealed that their databases were among those accessed, potentially impacting supporters.
These include Myton Hospices, Sheffield Hospital Charity, Priscilla Bacon Hospice Charity and Rowcroft Hospice in the healthcare sector, homelessness charity the Clock Tower Sanctuary and Victim Support.
The type of data thought to have been affected includes names, email addresses, telephone numbers and donation records. Beacon said that its customers should assume all data they store in its platform, including attachments, has been downloaded.
The company said it observed a “spike in activity” during the incident timeline that is symptomatic of data leaving its systems.
“If you were storing data about people in your Beacon account, it is likely to have been downloaded and as such you need to evaluate whether you must in turn notify the people you store in Beacon,” Beacon wrote in its incident update from August 4.
While the stored data was in an encrypted state, Beacon said it is possible that the unauthorised actor has been able to decrypt it.
The compromised CRM system does not hold sensitive patient information, payment card details or bank account information.
Beacon has informed customers that they can safely continue to collect payments via Beacon forms, but they must follow the steps in the Security Incident Response Guide in order to update their payment providers and apps.
Impacted charities have also been told to report the breach to the UK’s Information Commissioner’s Office (ICO).
Compromised Credentials Led to Data Breach
Beacon revealed in its public statement that a compromised access key was used to gain access to its systems. No details have been provided as to how this key was obtained.
“This was more sophisticated than a simple compromised username and password,” the CRM provider noted.
In its statement to Infosecurity, Beacon said the incident has now been contained with the assistance of external cybersecurity experts, who have launched an investigation into the full circumstances of the incident.
“Since containing the initial incident, we have not identified or observed any ongoing unauthorised access to Beacon’s systems. Our customers continue to access our platform and services as normal,” the spokesperson confirmed.
What the Incident Could Mean for Charity Victims
The cyber-attack has not yet been attributed to a specific threat actor, and it remains unclear what their objectives were or how they intend to use any compromised data.
No data linked to the incident has appeared on the dark web to date.
In other incidents involving the compromise of data held by third-party services, attackers have extorted victim organizations, threatening to make the stolen information public unless a payment is made. This occurred in the campaign that impacted Snowflake customer instances in 2024.
Commenting on the incident, Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, said that the charitable sector is a “persistently underappreciated target” when it comes to cyber-attacks.
“Donor databases hold exactly the kind of personally identifiable information – names, addresses, giving history, Gift Aid declarations linking financial behavior to identity that enables targeted fraud and social engineering,” he said.
“The assumption that charities are too small or too mission-driven to be worth targeting is precisely what makes them attractive. Security investment in the sector is typically minimal, third-party platform dependency is high, and the reputational stakes of a breach are significant for organizations whose entire model depends on donor trust,” Patel explained.
