A cyberattack, potentially the largest ever targeting the charity sector, has compromised data from up to 1,000 organizations, including prominent charities like Breast Cancer UK and the English National Ballet. The breach is believed to have resulted from a "huge human error" when cybercriminals targeted Beacon CRM, a software provider for the charity sector.
Investigators suspect that an access key, likely published online by Beacon, allowed hackers to copy databases. This exposure could have exposed millions of charity supporters' names and contact details. While payment information was not compromised, security experts warn that the stolen data could be used to launch sophisticated phishing attacks, leveraging knowledge of individuals' donation histories.
Victims are advised to change passwords and remain vigilant for suspicious emails or texts. Experts express particular concern for elderly individuals, who are often generous donors and may be more vulnerable to such scams. Beacon, which serves over 1,000 clients including Girlguiding and various NHS and animal rescue charities, has urged all its customers to assume they may have been affected.
Details of the compromised data may include names, contact information, communication preferences, donation history, Gift Aid records, event bookings, and in some cases, gender and date of birth. The breach is thought to have occurred between July 27 and July 31. The Metropolitan Police's Cyber Crime Unit and the Information Commissioner's Office are investigating the incident.
Beacon stated it engaged external cybersecurity experts who contained the incident and is committed to supporting its customers in their onward communication regarding potential data impacts. A professor of cyber-security at Ulster University noted that criminal organizations are increasingly targeting IT managers, seeing them as holding "keys to the kingdom."