UK Cybercrime Journal: Beacon CRM Breach Impacts Over 1,500 Charities

What Happened

In late July 2026, Beacon CRM, a UK-based customer relationship management platform serving over 1,500 non-profit and charitable organisations, suffered a major supply chain cyber incident that resulted in the unauthorised exfiltration of its database backups.
The compromise began around 27 July 2026, when the unknown attackers gained initial access by leveraging an AWS access key that was inadvertently exposed in publicly accessible JavaScript build artifacts.
Over a two-day period of 27–28 July, the attacker used these credentials to download full database backups containing records from over 1,000 UK charity customers.
Beacon CRM detected the unauthorised activity on 29 July, revoked the exposed credentials, and began notifying affected organisations between 30 July and 3 August. Public announcements and regulatory notifications followed, including press releases from the UK Charity Commission.
While payment card numbers and live bank details were not stored within the affected Beacon CRM database, exported backups included names, email addresses, phone numbers, home addresses, donation histories, and uploaded attachments (including Gift Aid declarations and user notes).
Several charities noted that historical records and data previously requested for deletion were retained within stored system backups, exposing older records belonging to past donors and service users.

An example list of charities who publicly stated they were impacted by the Beacon CRM breach is as follows:

The Robert Burns Ellisland Trust (here)
Lincoln Cathedral and Magna Vitae (here)
English National Ballet (here)
Yorkshire's Brain Tumour Charity (here)
The Sheffield Hospitals Charity (here)
The Shrewsbury and Telford Hospital Charity (here)
The Molly Rose Foundation (here)
The British Deaf Association (here)
The Message Trust (here)
The London Irish Centre (here)
Saint Catherine’s Hospice (here)
LawCare (here)

Analyst Comment

The Beacon CRM incident highlights the severe operational and reputational leverage inherent to single-point SaaS vendor dependencies in the non-profit sector. Non-profits heavily lean on SaaS providers due to resource constraints. When a centralised vendor suffers a credential breach, it creates a cascading effect across hundreds of downstream organisations that lack dedicated in-house cybersecurity teams.

Hardcoded and leaked API credentials, such as AWS access keys in this case, via client-facing build files remains a high-impact, easily preventable vulnerability class. Static secret-scanning tools and secrets management solutions should prevent raw production keys from ever reaching public JavaScript deployment packages. Unfortunately, this attack vector continues to be effective as other organisations such as Arup Group and Manchester Airports Group were also targeted by FulcrumSec using the same method.

While direct financial theft via credit cards was avoided, the exfiltrated dataset (names, donation history, Gift Aid details, home addresses) provides ideal conditions for social engineering, phishing, and targeted identity fraud directed at donors and vulnerable service users.

Defensive Takeaways

Automate Secret Scanning in CI/CD Pipelines: Implement continuous integration (CI) repository scanners (such as GitGuardian, Trufflehog, or AWS Secrets Manager tools) to detect and block access keys, API tokens, and secret strings before deployment to build artifacts.
Strict Identity & Access Management (IAM) Scoping: Restrict AWS keys using least-privilege principles. Access keys utilised by application or build layers should never have global or elevated permissions allowing direct read/export access to full infrastructure backups or AWS S3 buckets containing raw database snapshots.
Third-Party SaaS Incident Response Planning: This case highlights the importance of maintaining up-to-date inventories of third-party processors and sensitive data classifications. Ensure contractual SLAs specify rapid incident notification timelines, and maintain actionable response plans to satisfy the UK ICO's 72-hour reporting rule upon vendor disclosure.
Credential Rotation & Session Invalidation: Immediately rotate integrated API keys, webhooks, and Single Sign-On (SSO) tokens connected to third-party software platforms following an upstream compromise notification.

Relevant Sources

Relevant CTI Sources

https://www.sans.org/blog/hunting-saas-threats-insights-for589-course-cybercriminal-campaigns

Ransomware Tool Matrix Project Updates: May 2025

Introduction This blog is a summary and analysis of recent additions to the Ransomware Tool Matrix (RTM) as well as the Ransomware Vulnerability Matrix (RVM) . Feedback from the infosec community about these projects has been overwhelmingly positive and many researchers have contacted me to tell me how helpful they have found these to be. It makes me happy to hear how doing something in my spare time can help stop ransomware attacks and cybercriminals from exploiting our society’s systems. And it is for that reason, I shall continue to maintain these projects as long as ransomware is still around. For anyone new to these projects, please read the descriptions on GitHub or feel free to watch my talk explaining the project at BSides London . Background on the current ransomware ecosystem as of May 2025 Following the impact of Operation Cronos against LockBit and the exit scam by ALPHV/BlackCat, the ransomware ecosystem has been even more unstable than usual. The e...

Lessons from the BlackBasta Ransomware Attack on Capita

Introduction When a company that manages data for millions of UK citizens falls victim to ransomware, the whole industry should pay attention to it. On 15 October 2025, the UK Information Commissioner’s Office (ICO) published a detailed 136 page report about the Capita breach. The aim of this blog is to extract actionable cybersecurity lessons from the ICO’s findings as well as open source reports surrounding the breach from a cyber threat intelligence (CTI) analyst’s perspective to help SOC and CERT teams, and CISOs understand what happened and how to avoid the mistakes made by others. BLUF Incident Impact Summary: Capita was attacked by BlackBasta ransomware in March 2023 Over six million individual’s records were exfiltrated from Capita’s systems A £14 million fine was issued to Capita by the ICO Capita said in May 2023, the incident cost up to £20 million to recover Important context about Capita The Capita Group is a business process outsourcing (BPO) and professional servic...

Tracking Adversaries: EvilCorp, the RansomHub affiliate

Introduction This blog is part of a cyber threat intelligence (CTI) blog series called Tracking Adversaries that investigates prominent or new threat groups. The focus of this blog is EvilCorp, a sanctioned Russia-based cybercriminal enterprise known for launching ransomware attacks, and RansomHub, a prominent ransomware as a service (RaaS) operation run by Russian-speaking cybercriminals. These two threat groups have been linked together through cooperation on intrusions and IOCs and TTPs shared by multiple CTI sources. The implication of this link is critical due to RansomHub being the most active ransomware gang and is working with a well-known sanctioned affiliate. Who is RansomHub? Active since February 2024, RansomHub is a RaaS operation formerly known as Cyclops and Knight and is run by Russian-speaking adversaries. It is currently used by more and more cybercriminals that are ex-affiliates of other RaaS operations. This includes the ALPHV/BlackCat RaaS an...