[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSsQHYp4e-7XoPsweZnlcOd64FmkEY524RbLOS2YV0zo":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"0e51bc8c-7413-4eb4-b349-9130741fc1aa","Over 1,000 Charities Hit by Beacon CRM Data Breach","over-1-000-charities-hit-by-beacon-crm-data-breach-d6d5f2","The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts. The post Over 1,000 Charities Hit by Beacon CRM Data Breach appeared first on SecurityWeek.","UK-based CRM provider Beacon has disclosed a data breach affecting over 1,000 charities. The incident, which occurred between July 27-28, involved hackers downloading encrypted customer database backups. The root cause is believed to be a compromised AWS access key exposed in public JavaScript build artifacts, allowing attackers to exfiltrate all data from the database. While sensitive financial information was not compromised, personal details like names, phone numbers, and email addresses may have been exposed.","Beacon CRM data breach exposes over 1,000 charities' donor and supporter information.","https:\u002F\u002Fwww.securityweek.com\u002Fover-1000-charities-hit-by-beacon-crm-data-breach\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F07\u002Fdata-breach-healthcare-medical.jpg","2026-08-14T09:20:28+00:00","2026-08-14T10:00:21.124643+00:00",7,[17,20],{"name":18,"type":19},"Beacon","vendor",{"name":21,"type":22},"CRM","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18],{"controls":49,"vendors":136},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":80,"name":81,"problem":82,"products":83},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[84,92,99],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":94,"url":97,"description":98},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"slug":108,"name":109,"problem":110,"products":111},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":155},"exposed-aws-key-in-public-js-artifacts-leads-to-mass-charity-data-breach","Exposed AWS Key in Public JS Artifacts Leads to Mass Charity Data Breach","The root cause of this breach was a critical secret management failure: an AWS access key was inadvertently embedded in publicly accessible JavaScript build artifacts, granting attackers full access to cloud storage containing database backups. This represents a classic 'secrets in code' vulnerability that is entirely preventable with proper CI\u002FCD pipeline hygiene and pre-commit scanning tools. The incident affected over 1,000 charities, exposing personal data of their donors and beneficiaries — populations who trusted these organisations with sensitive information. For SaaS providers serving mission-driven organisations, a single misconfiguration can have cascading reputational and regulatory consequences across an entire customer base, underscoring the outsized responsibility third-party vendors carry.",[142,143,144,145,146,147,148,149,150,151,152,153,154],"CIS Control 3: Data Protection","CIS Control 5: Account Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SC-28: Protection of Information at Rest","NIST SP 800-53 AU-2: Event Logging","GDPR Article 5(1)(f): Integrity and Confidentiality","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","OWASP: Secrets Management Cheat Sheet","ISO\u002FIEC 27001: A.9.4 System and Application Access Control","ISO\u002FIEC 27001: A.12.3 Information Backup",{}]