Beacon CRM cyber-security incident

On 3 August 2026, Beacon informed us that it had experienced a cyber-security incident. Beacon confirmed that an unauthorised third party had gained access to its systems.

Beacon has since continued its investigation with external cyber-security specialists and provided the BDA with further findings on 12 August 2026.

Beacon has identified the earliest malicious activity as taking place on 27 July 2026. The unauthorised activity lasted for approximately 1 hour and 27 minutes.

Beacon believes the most likely cause was a compromised access key which allowed the attacker to access its Amazon Web Services (AWS) environment.

Beacon's investigation found a significant increase in data being transferred from its systems at the time of the attack. Based on this and the amount of data stored within its systems, Beacon's current assessment is that the attacker exported all data contained within the database.

Beacon has also advised that a copy of the database holding customer data, including attachment files, was made and likely downloaded in a readable form.

The data was encrypted while stored within Beacon's systems. However, because the attacker had valid access credentials, Beacon has confirmed that downloaded information would have been available to the attacker in a readable form.

Beacon cannot determine exactly which individual records or files were downloaded or where the downloaded information was sent.

There is currently no evidence that information associated with the incident has been published, disclosed or otherwise misused.

What information should I assume was involved?

Because Beacon's current assessment is that all data contained within its database was exported, the BDA is now treating all information held within our Beacon account at the time of the incident as affected.

The information held about each person varies. Depending on how you have interacted with the BDA, it may include:

• your name and contact details;
• your date of birth, where provided;
• membership information;
• donation, payment and Gift Aid records;
• event attendance, dietary or accessibility information;
• communication preferences;
• information you provided about disability, health or whether you identify as Deaf, DeafBlind, hard of hearing or hearing;
• award nomination information; and
• notes or attachments connected with your record.

Not all of these categories will apply to everyone. Some people will have much less information recorded than others.

Beacon has said there is no evidence that payment card details were compromised.

Beacon cannot provide the BDA with a list showing exactly which information relating to each individual was downloaded. We are therefore taking the cautious approach of treating information stored within our Beacon account as affected.

What are the possible risks?

The information could potentially be used to make phishing, impersonation or attempted fraud more convincing. The disclosure of personal or sensitive information could also cause distress or a loss of privacy.

There is currently no evidence that this has happened, but we are informing you so that you can remain alert and take sensible precautions.

What have we done?

• reported the personal data breach to the Information Commissioner’s Office (ICO);
• provided the ICO with Beacon's further forensic findings received on 12 August 2026;
• reported the incident to the Charity Commission;
• contacted people who may have been affected;
• reviewed the types of information held in our Beacon account and assessed the potential risks;
• disconnected integrations with Beacon as an immediate precaution and reviewed, revoked or replaced relevant access credentials and API keys;
• followed Beacon’s immediate security recommendations; and
• continued to obtain and review information from Beacon as its investigation progresses.

Beacon has told us that the likely vulnerability has been fixed, relevant credentials have been reset and no continuing unauthorised access has been identified.

We are also reviewing access to Beacon, third-party integrations, data retention and the information we need to continue holding within the system.

What should you do?

You do not need to take any immediate action, but we recommend that you:

• be cautious of unexpected emails, telephone calls, text messages or social media messages;
• be particularly careful about messages claiming to be from the BDA, Beacon or an organisation connected with a donation or event;
• do not provide passwords, payment information or other personal details in response to an unexpected message;
• do not click links or open attachments unless you are confident that the message is genuine; and
• contact us directly if you receive anything suspicious claiming to be from the BDA.

What happens next?

Beacon's investigation is continuing and it expects to provide customers with a final summary of its findings in the coming weeks.

We will review that information when we receive it and take any further action that may be needed.

At present, Beacon has found no evidence that information associated with the incident has been published or misused. However, we continue to recommend that you remain alert to unexpected emails, text messages, telephone calls or social media messages.

We will update this page if we receive further information that materially changes what people need to know or do.

More information

Further information, including frequently asked questions and safety guidance, is available below.

A BSL version of our original notice is also available on this page. Please note that the original BSL video was recorded before Beacon provided its further investigation findings on 12 August 2026. The latest written information is provided above.

We are very sorry that this has happened and for any concern it may cause. It is our understanding that Beacon is widely used by a large number of charities and organisations which have been affected by this cyber-security incident.

For questions about the incident, please contact:

dataprotection@bda.org.uk