Thousands of UK charities impacted by major Beacon CRM data breach

A major breach at cloud-based CRM provider Beacon CRM has exposed thousands of UK charities and non-profit organisations to significant data security incidents.

 

Beacon CRM is a UK-based cloud customer relationship management (CRM) platform headquartered in Bristol, England. Designed for charities and nonprofit organisations, it provides tools for donor management, fundraising, volunteer coordination, event management, and supporter engagement through a single cloud-based platform. Its clients include Special Olympics Ireland, Wimbledon Guild, Edinburgh Dog & Cat Home, Foothold, GuildCare, Sheffield Hospitals Charity, British Deaf Association and more.

 

Earlier this month, several charities and non-profit organisations reported significant data security incidents following a cyber attack on Beacon. Among those to publicly disclose breaches were Guild Care, Yorkshire’s Brain Tumour Charity and the British Deaf Association, with a number of other organisations also reporting that they had been affected.

 

Other UK charities that have since disclosed data breaches have warned that as many as 1,000 charities could potentially be affected, as they use Beacon as their CRM provider.

 

“Beacon CRM, the system that Break uses for managing our supporter and contact data, was recently affected by a cyber-security incident. Beacon is used by over 1,000 charities as their CRM, who have all been affected by the incident,” Break Charity said.

 

While some charities have warned that supporters’ personal information may have been compromised, including names, telephone numbers, email addresses and postal addresses, others have stressed that sensitive financial details were not affected. This includes bank account numbers, sort codes, card numbers and card security information, as such data is not stored on the Beacon platform.

 

In a recent update, Beacon said that it received further updates from its external cyber security experts confirming “that a copy of the database which holds all Beacon customer data, including attachment files, was made and likely downloaded in a readable format by the threat actor.”

 

“The probable root cause of this incident was a compromised AWS access key which was potentially exposed in public JavaScript build artifacts. The earliest malicious activity observed so far occurred on 27 July 2026 at 01:20:16 UTC and lasted for approximately 1 hour and 27 minutes.

 

“Analysis of the AWS Cost & Usage reports across May-July 2026 has been conducted. This data showed a significant increase in data transfer on 27–28 July 2026. This timing correlates with the malicious activity, which supports an assessment that substantial downloads occurred,” Beacon added.