Multiple UK charities hit by data security incidents following Beacon CRM breach

Several UK organisations have disclosed data security incidents after their cloud-based CRM provider, Beacon CRM, experienced a significant cybersecurity incident that may have compromised customer data.

 

Beacon CRM is a UK-based cloud customer relationship management (CRM) platform headquartered in Bristol, England. Designed for charities and nonprofit organisations, it provides tools for donor management, fundraising, volunteer coordination, event management, and supporter engagement through a single cloud-based platform. Its clients include Special Olympics Ireland, Wimbledon Guild, Edinburgh Dog & Cat Home, Foothold, GuildCare, Sheffield Hospitals Charity, British Deaf Association and more.

 

In a data security incident notice published on its website, Guild Care said that on August 3, its third-party provider, Beacon CRM, which stores and manages supporters’ information, informed the organisation of a data security incident affecting Beacon CRM’s internal network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“Beacon is currently investigating the breach, which they detected on Wednesday 29th July. 

 

“Beacon’s current understanding is that compromised credentials were used to access their systems and download database backups. Although data is stored in an encrypted state, decryption remains a potential risk. Currently, there is no evidence of the data being used in any way,” Guild Care said.

 

The compromised data included names, email addresses, and organisational information. Beacon has confirmed that it does not store any sensitive financial information, such as credit card or bank account information.

 

“Guild Care is notifying all contacts directly and assessing whether this incident meets the threshold for formal reporting to the Information Commissioner’s Office (ICO),” Guild Care added.

 

Several other organisations have also reported experiencing similar data security incidents linked to the Beacon CRM breach. Among those affected are the British Deaf Association, Saints Foundation, Full Fact, and other charities and non-profit organisations that rely on Beacon CRM to store and manage supporter, donor, or operational information. These organisations have begun notifying affected individuals and reviewing the extent of the impact, with details varying depending on the type of data held within their Beacon CRM systems.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Beacon. The cloud-based customer relationship management provider also did not share details on who was behind the attack, how much data was compromised, whether it had received a ransom demand or the number of affected people.