Over 1,000 Charities Hit by Beacon CRM Data Breach
Source SecurityWeek
Description
The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts. The post Over 1,000 Charities Hit by Beacon CRM Data Breach appeared first on SecurityWeek .
Impact
The breach exposed personal information of supporters for over 1,000 UK charities using Beacon CRM, including names, phone numbers, email addresses, and postal addresses. Although financial data such as bank account numbers and card details were not stored or compromised, the exposure of personal data poses privacy risks to affected individuals and reputational damage to the charities. The full database was likely exfiltrated, increasing the scope of the impact. The incident has attracted regulatory attention from the UK Charity Commission, which may result in compliance and reporting obligations for affected organizations.
Defensive guidance
Beacon CRM should ensure that all AWS access keys and other sensitive credentials are securely managed and never exposed in publicly accessible artifacts such as JavaScript builds. Immediate rotation and revocation of compromised AWS keys is critical. Organizations using Beacon CRM should follow guidance issued by the UK Charity Commission. Since this is a cloud environment breach involving compromised credentials, remediation involves credential management improvements and monitoring for unauthorized access. Patch status is not applicable as this is a credential exposure issue rather than a software vulnerability. Users should verify that their data is no longer accessible and consider additional protective measures such as notifying affected individuals and monitoring for misuse of exposed personal data.
Summary
Beacon CRM experienced a data breach traced to a compromised AWS access key that was inadvertently exposed in publicly accessible JavaScript build artifacts. This allowed threat actors to access the AWS environment and download encrypted backups of customer databases. Although the data was encrypted, Beacon acknowledged the possibility that attackers decrypted the data prior to exfiltration. The breach affected the entirety of the database, impacting over 1,000 charity organizations using Beacon's platform. Personal identifying information of supporters was potentially exposed, but sensitive financial information was not stored or compromised. The earliest malicious activity was observed on July 27, 2026, with data transfers occurring on July 27-28. The UK Charity Commission is actively monitoring the situation and providing guidance. There is no evidence of data publication or attribution to any cybercrime group.
References
Community reviews
Related threats
- CVE-2026-126793: AWS Advanced Go Wrapper · Privilege escalation in Aurora PostgreSQL dialect detectionHighVulnerability
- CVE-2026-127119: awswrangler · Unverified ownership of the default EMR cluster log location in AWS SDK for pandasHighVulnerability
- VU#685399: PromZard context key code injection leads to remote code executionHighVulnerability
- The XG Files: Falcon C2 Flying Under The (Browser) RadarMalware
- Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware