Beacon CRM cyber-security incident

On 3 August 2026, Beacon informed us that it had experienced a cyber-security incident. Beacon has confirmed that an unauthorised third party gained access to its systems, copies of customer database backups were made, and the available evidence suggests that those copies were likely downloaded.

Beacon has advised its customers to assume that information stored within their accounts, including attachments, may have been involved. There is currently no evidence that the information has been published or misused.

What information may have been involved?

The information held about each person varies. Depending on how you have interacted with the BDA, it may have included:

• your name and contact details;
• membership information;
• donation, payment and Gift Aid records;
• event attendance, dietary or accessibility information;
• communication preferences;
• information you provided about disability, health or whether you identify as Deaf, DeafBlind, hard of hearing or hearing;
• award nomination information; and
• notes or attachments connected with your record.

Not all of these categories will apply to everyone. Beacon has said there is no evidence that payment card details were compromised.

At present, neither Beacon nor the BDA can confirm exactly which individual records were downloaded or viewed, due to the type of cyber-attack experienced.

What are the possible risks?

The information could potentially be used to make phishing, impersonation or attempted fraud more convincing. The disclosure of personal or sensitive information could also cause distress or a loss of privacy.

There is currently no evidence that this has happened, but we are informing you so that you can remain alert and take sensible precautions.

What have we done?

• reported the incident to the Information Commissioner’s Office;
• reviewed the types of information held in our Beacon account and assessed the potential risks;
• reviewed and secured the integrations and access credentials connected with Beacon;
• followed Beacon’s immediate security recommendations; and
• continued to work with Beacon and monitor its investigation.

Beacon has told us that it has contained the incident and is continuing its investigation with external cyber-security specialists.

What should you do?

You do not need to take any immediate action, but we recommend that you:

• be cautious of unexpected emails, telephone calls, text messages or social media messages;
• be particularly careful about messages claiming to be from the BDA, Beacon or an organisation connected with a donation or event;
• do not provide passwords, payment information or other personal details in response to an unexpected message;
• do not click links or open attachments unless you are confident that the message is genuine; and
• contact us directly if you receive anything suspicious claiming to be from the BDA.

More information

Further information, including an FAQ and a BSL version of this notice, is available here:

We are very sorry that this has happened and for any concern it may cause. It is our understanding that Beacon is widely used by a large number of charities and organisations which have been affected by this cyber security incident.

For questions about the incident, please contact:

dataprotection@bda.org.uk

We will update the information on our website if Beacon provides any significant new findings.