Data Breach Hitting Charities

Data Breach Stealing names, addresses and financial information

Beacon CRM, a third party Customer Relationship Management (CRM) system used by thousands of charities has admitted to experiencing a cyber incident. I have been informed today "The nature of the incident is still being investigated by Beacon, but it is evident that there was unauthorised access to its systems."

Yesterday the BBC reported "Yorkshire's Brain Tumour Charity (YBTC) has become the latest victim of a data breach which could put the personal details of its users and supporters at risk". Read more about this article here. Beacon has admitted an "unauthorised third party" had accessed their systems, and exported data, which sadly include names, addresses, and health information.

What Happened? Beacon became aware of the incident on 29 July 2026. An unauthorised 3rd party used compromised login details to access Beacon’s systems copy database information. Beacon is advising charities to assume stored information on the platform, including attachment files, may have been taken.

Charities were notified 3 August, five days after the breach. Data stolen can include names, addresses, email addresses, phone numbers, dates of birth, and donation or payment records.

Beacon has notified the relevant authorities and reported the incident to the Information Commissioner’s Office (ICO).

Charities impacted so far: Actors Trust, Yorkshire Brain Tumour Charity. There will be many more and as the information is released we will keep you up to date.

Advice: Keep vigilant and anticipate phishing, vishing and smishing. If you are targeted it is reasonable to assume fraudsters will try to gather more data, building a profile with the potential for identity theft and or debit/credit card fraud. Read more on how to protect yourself from phishing here.