Over 1,000 Charities Hit by Beacon CRM Data Breach
Beacon CRM data breach exposes over 1,000 charities' donor and supporter information.
UK-based CRM provider Beacon has disclosed a data breach affecting over 1,000 charities. The incident, which occurred between July 27-28, involved hackers downloading encrypted customer database backups. The root cause is believed to be a compromised AWS access key exposed in public JavaScript build artifacts, allowing attackers to exfiltrate all data from the database. While sensitive financial information was not compromised, personal details like names, phone numbers, and email addresses may have been exposed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Beacon?
Get an email when a new story names Beacon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause of this breach was a critical secret management failure: an AWS access key was inadvertently embedded in publicly accessible JavaScript build artifacts, granting attackers full access to cloud storage containing database backups. This represents a classic 'secrets in code' vulnerability that is entirely preventable with proper CI/CD pipeline hygiene and pre-commit scanning tools. The incident affected over 1,000 charities, exposing personal data of their donors and beneficiaries — populations who trusted these organisations with sensitive information. For SaaS providers serving mission-driven organisations, a single misconfiguration can have cascading reputational and regulatory consequences across an entire customer base, underscoring the outsized responsibility third-party vendors carry.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.