Beacon CRM cyber incident: charities told to act as if supporter data has been taken

Howard Lake | 5 August 2026 | News

• Tagged with:
• beacon crm
• Charity CRM
• data
• data protection
• Law / policy
• security

Beacon CRM, the customer relationship management platform used by many UK charities, has suffered a cyber security incident, and has advised all of its customers to act as if their databases have been compromised.

The incident took place on Wednesday 29 July 2026. Beacon notified its customers, most of them charities, on Monday 3 August. According to notifications now being sent by those charities to supporters and contacts, there is at this stage no evidence that any data has been shared, but it is possible that all of the data held on the Beacon platform was downloaded. Beacon has said the entry point was compromised credentials.

The CRM is used by charities to manage their relationships with donors, supporters, volunteers and beneficiaries. All of Beacon’s technology is based entirely in the UK.

Charities affected are contacting their supporters and other contacts directly and preparing reports for the Information Commissioner’s Office (ICO), as required when personal data may have been breached. Among the first to notify their contacts were DataKind UK, Breast Cancer UK and the Institute for Voluntary Action Research (IVAR). Other charity clients include English National Ballet, the Molly Rose Foundation,

What kind of data was held?

The personal data held on the platform varies by charity but may include a supporter’s name, email address, job title, employer, postal address, LinkedIn profile, contact preferences and mailing list subscriptions, email correspondence, project or volunteering records, and events they had signed up for. The charities notifying supporters have stressed that Beacon does not store payment card information.

How Beacon responded

In a statement on the incident a spokesperson stated:

“We are currently investigating the full circumstances of the incident with external cyber-security specialists, but our current understanding is that compromised credentials were used to gain access to Beacon”

They added that “copies of database backups were made”.

The company has published a page on its website about the incident with related updates and advice for users.

In addition to implementing “immediate measures” to secure its systems and to prevent any further unauthorised access, the company reassured its clients that “you can be confident that Beacon is secure and available for our customers to use as normal. Beyond our immediate containment actions, Beacon hasn’t experienced any service interruption as a result of this incident”. 

The page covers advice for charity clients includes completing a Beacon security checklist, updating their app guide, finding their internal policies, considering their regulatory obligations, information that they would need to provide the ICO, considering the impact on individuals, and how to notify individuals if they deem they need to do so.

In addition to the incident statement they have published a range of content in a FAQs section.

Charities’ actions

Charities are advising supporters to be alert to phishing: to treat with caution any unexpected message claiming to come from a charity they support, and never to share passwords, verification codes or financial details in response to an unsolicited request.

Data incidents of this kind are a reminder that a charity’s duty of care to its supporters extends to the third-party systems it relies on. Charities that use Beacon and have not yet heard from the company should check their account and follow its guidance.

Beacon CRM has maintained a trusted reputation amongst many, and only in May this year marked being rated the number one CRM for charities for the seventh year running in Fundraising Magazine’s annual survey.

• Beacon CRM is now 100% climate positive (17 December 2019)
  
• Charity data at risk after breack at National Lottery Community Fund (23 July 2021)
  
• ICO launches audit framework to help charities with data protection compliance (10 October 2024)

About Howard Lake
Howard Lake is consultant editor of UK Fundraising. He founded the site in 1994 and successfully sold it in 2022. As director of Giving X Ltd he is exploring growing giving on a massive scale. He is the founder of Fundraising Camp and co-founder of GoodJobs.