# Beacon CRM cyber incident: charities told to act as if supporter data has been taken

- Link: https://fundraising.co.uk/2026/08/05/beacon-crm-cyber-incident-charities/
- Published: 2026-08-05T16:28:36+01:00
- Author: Howard Lake

**Beacon CRM, the customer relationship management platform used by many UK charities,
has suffered a cyber security incident, and has advised all of its customers to 
act as if their databases have been compromised.**

The incident took place on Wednesday 29 July 2026. [Beacon](https://beaconcrm.org)
notified its customers, most of them charities, on Monday 3 August. According to
notifications now being sent by those charities to supporters and contacts, there
is at this stage no evidence that any data has been shared, but it is possible that
all of the data held on the Beacon platform was downloaded. Beacon has said the 
entry point was compromised credentials.

The CRM is used by charities to manage their relationships with donors, supporters,
volunteers and beneficiaries. All of Beacon’s technology is based entirely in the
UK.

## Advertisement

Charities affected are contacting their supporters and other contacts directly and
preparing reports for the Information Commissioner’s Office (ICO), as required when
personal data may have been breached. Among the first to notify their contacts were
DataKind UK, Breast Cancer UK and the Institute for Voluntary Action Research (IVAR).
Other charity clients include English National Ballet, the Molly Rose Foundation,

## What kind of data was held?

The personal data held on the platform varies by charity but may include a supporter’s
name, email address, job title, employer, postal address, LinkedIn profile, contact
preferences and mailing list subscriptions, email correspondence, project or volunteering
records, and events they had signed up for. The charities notifying supporters have
stressed that **Beacon does not store payment card information**.

## How Beacon responded

In a statement on the incident a spokesperson stated:

> “We are currently investigating the full circumstances of the incident with external
> cyber-security specialists, but our current understanding is that compromised 
> credentials were used to gain access to Beacon”

They added that “copies of database backups were made”.

The company has published a page on its website about the incident with related 
updates and advice for users.

In addition to implementing “immediate measures” to secure its systems and to prevent
any further unauthorised access, the company reassured its clients that “you can
be confident that Beacon is secure and available for our customers to use as normal.
Beyond our immediate containment actions, Beacon hasn’t experienced any service 
interruption as a result of this incident”. 

The page covers advice for charity clients includes completing a Beacon security
checklist, updating their app guide, finding their internal policies, considering
their regulatory obligations, information that they would need to provide the ICO,
considering the impact on individuals, and how to notify individuals if they deem
they need to do so.

In addition to the incident statement they have published a range of content in 
a FAQs section.

## Charities’ actions

Charities are advising supporters to be alert to phishing: to treat with caution
any unexpected message claiming to come from a charity they support, and never to
share passwords, verification codes or financial details in response to an unsolicited
request.

Data incidents of this kind are a reminder that a charity’s duty of care to its 
supporters extends to the third-party systems it relies on. Charities that use Beacon
and have not yet heard from the company should check their account and follow its
guidance.

Beacon CRM has maintained a trusted reputation amongst many, and only in May this
year marked being [rated the number one CRM for charities for the seventh year running](https://www.beaconcrm.org/blog/beacon-rated-1-in-fundraising-magazines-2026-crm-survey)
in Fundraising Magazine’s annual survey.

 * **[Beacon CRM is now 100% climate positive](https://fundraising.co.uk/2019/12/17/beacon-is-now-100-climate-positive/)(
   17 December 2019)
 * **[Charity data at risk after breack at National Lottery Community Fund](https://fundraising.co.uk/2021/07/23/charity-data-at-risk-after-breach-at-national-lottery-community-fund/)(
   23 July 2021)
 * **[ICO launches audit framework to help charities with data protection compliance](https://fundraising.co.uk/2024/10/10/ico-launches-audit-framework-to-help-with-data-protection-compliance/)(
   10 October 2024)**