ctipilot.ch

Beacon CRM access-key breach affecting around 1,500 UK charities

incident · incident:beacon-crm-uk-charities-breach-2026-08

UK charity-sector CRM provider Beacon disclosed (update of 2026-08-04) that a compromised access key was used to reach its systems and that copies of database backups were made and likely downloaded, advising customers to assume all stored data including attachments was taken. Beacon states data is stored encrypted but that its experts assess the attacker could plausibly have decrypted it before copying. Named affected charities include Victim Support, Myton Hospices, Sheffield Hospital Charity, Priscilla Bacon Hospice Charity, Rowcroft Hospice and The Clock Tower Sanctuary; Victim Support reported to the UK ICO and the Charity Commission.

Coverage timeline
1
first 2026-08-08 → last 2026-08-08
Peak priority
notable
1 notable
Sources cited
3
3 hosts
Sections touched
1
active-threats
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
3
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1078T1199T1213
Affected products
Beacon CRM
Tags
clouddata-breachsupply-chain

ATT&CK techniques

3 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Story timeline

  1. 2026-08-08Beacon CRM tells around 1,500 UK charities to assume everything they stored was taken — a compromised access key, exfiltrated backups, and encryption its experts think the attacker could undo
    active-threatsA charity-sector CRM breach reaches hospices, NHS-linked charities and Victim Support, with the vendor advising customers to assume total data loss

Where this entity is cited

  • active-threats1

Source distribution

  • beaconcrm.org1 (33%)
  • infosecurity-magazine.com1 (33%)
  • victimsupport.org.uk1 (33%)

explore in graph

All cited sources (3)

Entries about Beacon CRM access-key breach affecting around 1,500 UK charities (1)

2026-08-08 · view entry permalink →

NOTABLENATOA1

Beacon CRM tells around 1,500 UK charities to assume everything they stored was taken — a compromised access key, exfiltrated backups, and encryption its experts think the attacker could undo

Beacon, a CRM platform built for the UK voluntary sector and holding data for around 1,500 organisations, published an incident update on 2026-08-04 that is more candid than most and worse than its early framing suggested. Its investigation "has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party", supported by evidence of a spike in activity during the incident timeline symptomatic of data leaving its systems; because it judges it highly unlikely to establish which data related to whom, its advice to customers is that "you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded" (Beacon CRM, 2026-08-04).

The access path is the transferable part. Infosecurity Magazine reports that "Beacon revealed in its public statement that a compromised access key was used to gain access to its systems", with no detail published on how the key was obtained, and quotes the provider's characterisation that "This was more sophisticated than a simple compromised username and password" (Infosecurity Magazine, 2026-08-07). A programmatic key is not an account: it does not sit behind multi-factor authentication, does not trip impossible-travel logic, and in a multi-tenant platform it is frequently scoped to the platform rather than to a tenant — which is how a single credential becomes every customer's backup.

Encryption at rest did not close the gap either. Beacon states that while it stores data in an encrypted state, its experts have advised that on the available evidence it is possible the responsible party would have been able to decrypt it before copying it out (Beacon CRM, 2026-08-04). That is the expected outcome when the attacker holds an application-layer credential: the platform decrypts for its own legitimate operations, so a stolen key inherits that ability.

Downstream, individual charities are confirming and notifying separately. Victim Support published its own statement saying the evidence suggests "copies of database back-ups were made and likely downloaded by an unauthorised third party" and that it has reported the incident to the Information Commissioner's Office and the Charity Commission (Victim Support, 2026-08-04). Infosecurity names Myton Hospices, Sheffield Hospital Charity, Priscilla Bacon Hospice Charity and Rowcroft Hospice in the healthcare sector, plus homelessness charity The Clock Tower Sanctuary, with affected data including names, email addresses, telephone numbers and donation records (Infosecurity Magazine, 2026-08-07). No actor has claimed the breach and no leak-site listing has appeared.

Triage: an access-key compromise on a supplier platform produces no telemetry on the customer side at all — that is the defining property, and it is why the detection burden sits with the provider's own audit logging of key usage and egress volume rather than with anything a downstream charity could have seen. Where you operate the platform, the discriminator is the shape of the access, not its credentials: a valid key performing bulk reads or backup retrieval at a volume and hour outside its established pattern, against tenants it has never touched before.

our investigation has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party

you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded

Beacon CRM 2026-08-04

Beacon revealed in its public statement that a compromised access key was used to gain access to its systems.

Infosecurity Magazine 2026-08-07

copies of database back-ups were made and likely downloaded by an unauthorised third party

Victim Support 2026-08-04
incident08 Aug 05:10Zmulti-sourceOpen finding ↗
Sources: Beacon CRM · Victim Support · Infosecurity Magazine