A cyberattack on Beacon, a customer relationship management (CRM) provider, has resulted in the exposure of personal information belonging to supporters of approximately 1500 UK charities. The incident, which Beacon confirmed on August 12, was attributed to a compromised AWS access key.
Beacon's investigation suggests the access key was potentially exposed within public Javascript build artifacts, indicating a possible error during software development. The attacker reportedly used these valid credentials to access and download all data, including attachment files, from the CRM platform. This impacts Beacon's entire customer base of charitable organizations, some of which operate in sensitive areas such as healthcare and victim support. Although the data was encrypted at rest within AWS, the attacker's use of valid credentials meant the downloaded information was decrypted and accessible in readable form.
Analysis of Beacon’s AWS Cost & Usage reports pinpointed the malicious activity to a period beginning on July 27 at 01:20:16 UTC and lasting for approximately one hour and 27 minutes. This timeframe correlates with a significant surge in data downloads observed between July 27 and 28. Beacon has stated it found no evidence of the attacker attempting to maintain persistence within its environment and has since reset all credentials for services and accounts integrated with AWS to prevent further unauthorized access. As of now, there is no indication that the stolen data has been published online or otherwise misused.
The affected charities have been advised to report the breach to the UK's Information Commissioner's Office (ICO). The Survivor's Trust, a charity providing support for rape and sexual abuse victims, confirmed on August 13 that the ICO had reviewed its case and concluded the charity bore no responsibility for the breach. The Survivor's Trust has urged its supporters to remain vigilant against potential scams.
Several charities have publicly acknowledged that supporter information was compromised. These include Shrewsbury and Telford Hospital Charity, the British Deaf Association, Yorkshire's Brain Tumour Charity, Sheffield Hospital Charity, Priscilla Bacon Hospice Charity, the Clock Tower Sanctuary, and Victim Support. The exposed data is believed to include supporters' names, email addresses, telephone numbers, and donation records, which could be exploited for social engineering attacks. Beacon has confirmed that the compromised CRM system did not store sensitive patient information, payment card details, or bank account information.
