Up to 1,000 UK charities, including prominent organisations such as the English National Ballet and Historic Buildings and Palaces, have been affected by a data breach targeting customer management software provider Beacon CRM. The cyberattack, discovered last Wednesday and disclosed to affected clients by Monday, involved unauthorized access to the company’s backup databases using stolen login credentials.
Beacon CRM supplies software to a wide range of charities, with a client base that includes Girlguiding, Kidney Care UK, and numerous smaller organisations across sectors such as animal rescue, health, and sports. The breach has raised concerns about the security of sensitive personal data managed on the platform.
According to victim reports, the data potentially compromised includes names, contact details, communication preferences, membership histories, donation records, Gift Aid information, event bookings, correspondence related to charity relationships, and, in some cases, gender and date of birth. Both Historic Buildings and Places and the English National Ballet confirmed that no payment or password information appeared to have been compromised. The English National Ballet specifically noted that business contact information such as email addresses, phone numbers, and physical addresses were likely accessed.
Other affected organisations include Upper Room, a West London homeless charity, the Jersey branch of Macmillan Cancer Support, and the Chiswick House and Gardens Trust. Beacon’s advisory to its clients recommended changing passwords and maintaining vigilance against phishing attempts through emails or texts containing malicious links.
Beacon CRM, founded in 2017 and headquartered in London, responded promptly after detecting the incident by engaging external cybersecurity experts to investigate and secure its systems. The company stated that compromised credentials allowed hackers to access their systems and copy backup databases, although definitive evidence that the data was extracted has not yet been established. The method of attack—exploitation of stolen login details—raises questions about the effectiveness of the company’s multi-factor authentication and monitoring procedures. Cybersecurity experts note that backup databases often receive weaker protection, making them an attractive target for attackers.
Cybersecurity professor Alan Woodward of Surrey University highlighted the broader implications of the breach, emphasizing the risks posed by vulnerabilities within supply chains. He stated that the incident demonstrates how a single compromised credential can expose numerous organisations to regulatory and reputational risks. Woodward stressed that maintaining credential hygiene, enforcing multi-factor authentication, and imposing strict access controls, especially on backups, are essential safeguards for entities handling sensitive donor or beneficiary information.
Beacon holds cybersecurity certifications including Cyber Essentials Plus, a government-backed standard, underscoring the complexities charities face in aligning operational capabilities with evolving cyber threat landscapes. The ongoing investigation continues as the company and its clients assess the full scope and impact of the breach.