A major cyberattack, described by experts as a "huge human error" and potentially the largest ever targeting the U.K. charity sector, has put the personal data of millions of donors at risk. The breach affected Beacon CRM, a software provider used by approximately 1,000 charities.
Experts believe the incident occurred when an access key, likely for Amazon Web Services (AWS), was mistakenly published online. This exposed Beacon's databases to cybercriminals, who may have copied sensitive donor information. While payment details were not compromised, stolen data could include names, contact details, donation histories, and correspondence.
Charities such as Breast Cancer UK, National Ballet, Historic Buildings and Palaces, and the Molly Rose Foundation are among those caught in the breach. Beacon has advised all its clients to assume they have been affected and to inform their supporters accordingly. Some affected organizations have detailed that the stolen data could include names, contact details, communication preferences, membership or donation history, Gift Aid records, event bookings, correspondence, and for some individuals, gender and date of birth.
Security experts warn that the compromised information could be used to launch sophisticated phishing attacks. Hackers, armed with knowledge of which charities individuals have supported, may craft targeted scams. Elderly donors, who are often more generous, are considered particularly vulnerable to these types of attacks.
The breach is significant due to its scale and the centralized nature of the attack, affecting numerous charities simultaneously. "It's a cock-up, to use a technical term," said Alan Woodward, professor of cyber-security at Surrey University, referring to the apparent inadvertent publication of the access key. He noted that automated security sweeps, which should prevent such exposures, appeared not to have been conducted.
Kevin Curran, professor of cyber security at Ulster University, highlighted that cybercriminals increasingly target IT managers who hold critical access information. He reiterated concerns that a substantial portion of the stolen data may belong to elderly individuals.
The Met's Cyber Crime Unit and the Information Commissioner's Office (ICO) are investigating the incident, which is believed to have occurred between July 27 and July 31. Beacon, established in 2017, provides database management solutions for charities and carries cyber-security certifications on its website.
In a statement, Beacon confirmed a cyber-security incident involving unauthorized access to its systems. The company stated it engaged external experts who contained the incident and is committed to supporting its customers in communicating any potential data impact to their own stakeholders.