Beacon, a CRM provider for charities and nonprofits, has confirmed that an exposed AWS access key is the primary suspect in a July data breach that resulted in the copying and likely download of its entire customer database. The company's CTO, David Simpson, stated that the key was "potentially exposed in public JavaScript build artifacts," raising concerns about the effectiveness of Beacon's development pipeline and code review processes.
The breach, which began in the early hours of July 27, involved malicious activity lasting one hour and 27 minutes. During this period, the attacker copied the database, which contains all customer data, including attachment files. While Beacon's AWS data was encrypted at rest, the compromised access key likely allowed the threat actor to retrieve it in a readable format.
Analysis of AWS Cost & Usage reports for May through July 2026 revealed a significant increase in data transfer on July 27-28, correlating with the malicious activity and supporting the assessment that substantial downloads occurred. Beacon has over 1,500 customers, but the exact number of affected organizations or individuals has not been established. The company's logs cannot identify specific records that were exfiltrated.
Beacon has advised its customers to conduct their own risk assessments and review the data they stored in their CRM instances to determine potential exposure. Many charities that have confirmed their involvement in the breach have indicated that the compromised data primarily consists of personal information and donation details.
Since Beacon first disclosed the incident on August 4, numerous high-profile charities have confirmed they were affected. These include the Molly Rose Foundation, Macmillan Cancer Support Jersey, English National Ballet, Sheffield Hospitals Charity, Shrewsbury and Telford Hospital Charity, the British Deaf Association, and Lincoln Cathedral. The Charity Commission has reported a surge in serious incident reports related to the breach, causing delays in its response times.
Beacon has indicated that the attacker did not establish any persistence mechanisms within its AWS environment. While the company plans to provide a summary upon the conclusion of its investigation in a few weeks, Simpson cautioned that the level of detail in this final update might not be significantly greater than what has already been shared. He acknowledged that this might be frustrating for customers but emphasized the complexities inherent in such incidents.
