Beacon CRM, a platform utilized by over a thousand UK charities and non-profit organizations, has confirmed a significant data breach resulting in the complete exfiltration of its customer database. The breach was disclosed by Chief Technology Officer David Simpson on August 12, 2026, highlighting the severity of the incident.
The intrusion was traced back to a compromised Amazon Web Services (AWS) access key. This sensitive credential was inadvertently exposed within publicly accessible JavaScript build artifacts hosted on Beacon’s website. Such exposures can occur when automated build tools embed environment variables or secret keys into client-facing code, making them accessible to anyone inspecting web assets through a browser.
Forensic analysis revealed a substantial surge in data transfer on July 27 and 28, 2026, corresponding with the following timeline:
- Initial Access: Malicious activity commenced on July 27, 2026, at 01:20:16 UTC.
- Intrusion Duration: The attacker maintained access for approximately 1 hour and 27 minutes before it was terminated.
- Data Exfiltration: The volume of data transferred matched the total volume of stored platform records, indicating that the entire database and associated attachment files were exported.
Despite Beacon’s implementation of data encryption at rest within its AWS environment, the use of valid, stolen AWS access keys allowed the attacker to authenticate and decrypt the data seamlessly. Consequently, the exfiltrated records and attachments were downloaded in a fully readable format.
Following the breach, Beacon undertook several remediation steps:
- Credential Management: Revoked and rotated all AWS-integrated access keys and secrets.
- Code Security: Removed sensitive build parameters from client-side JavaScript assets.
- Enhanced Monitoring: Deployed endpoint detection tools and implemented SentinelOne Cloud Native Security across all enterprise environments and engineer workstations.
The incident has prompted regulatory involvement from the UK Charity Commission, the Information Commissioner’s Office (ICO), and Action Fraud. Affected non-profits, including Justice for Colombia and the Center for Sustainable Energy, have begun notifying supporters about the potential exposure of personal information and donation histories.
Continuous dark web monitoring has so far revealed no evidence of the stolen database being sold, published, or held for ransom. Beacon advises impacted client organizations to independently assess their data notification obligations while a final investigative report is being prepared.
This breach underscores the critical importance of securing access credentials and implementing robust monitoring systems. Organizations must ensure that sensitive keys are not embedded in publicly accessible code and should regularly audit their security practices to prevent similar incidents.
