CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Beacon CRM

product · product:beacon-crm

Coverage
1
first 2026-08-08 → last 2026-08-08
Latest activity
2026-08-08
A charity-sector CRM breach reaches hospices, NHS-linked charities and Victim Support, with the vendor…
Peak priority
notable
1 notable
Targets
healthcare
sectors: healthcare, legal-services, technology · regions: uk, europe
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Beacon CRM, newest first. Check the date before acting on an older one.

  • Enumerate every long-lived programmatic access key held by or issued to your SaaS suppliers and processors, and confirm each one is scoped below the level at which it could read a whole-tenant database backup, this breach turned one key into every customer's data, and no user credential or MFA control was in the path.
    2026-08-08A charity-sector CRM breach reaches hospices…

Defender insights

What each entry about Beacon CRM tells a defender to do, newest first.

2026-08-08NOTABLEA charity-sector CRM breach reaches hospices, NHS-linked charities and Victim Support, with the vendor advising customers to assume total data loss

Triage

Story timeline

  1. 2026-08-08Beacon CRM tells around 1,500 UK charities to assume everything they stored was taken, a compromised access key, exfiltrated backups, and encryption its experts think the attacker could undo
    active-threatsA charity-sector CRM breach reaches hospices, NHS-linked charities and Victim Support, with the vendor advising customers to assume total data loss

Hunting pivots

Releases covered
Beacon CRM
Tags
clouddata-breachsupply-chain
ATT&CK techniques (3 across 5 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Trusted Relationship
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • CollectionData from Information Repositories

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Collection TA0009

T1213Data from Information Repositories×1

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).

Evidence: 2026-08-08/beacon-crm-access-key-breach-uk-charities-hospices · ATT&CK page ↗

Entries about Beacon CRM (1)

2026-08-08 · view entry permalink →

NOTABLENATOA1

Beacon CRM tells around 1,500 UK charities to assume everything they stored was taken, a compromised access key, exfiltrated backups, and encryption its experts think the attacker could undo

Beacon, a CRM platform built for the UK voluntary sector and holding data for around 1,500 organisations, published an incident update on 2026-08-04 that is more candid than most and worse than its early framing suggested. Its investigation "has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party", supported by evidence of a spike in activity during the incident timeline symptomatic of data leaving its systems; because it judges it highly unlikely to establish which data related to whom, its advice to customers is that "you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded" (Beacon CRM, 2026-08-04).

The access path is the transferable part. Infosecurity Magazine reports that "Beacon revealed in its public statement that a compromised access key was used to gain access to its systems", with no detail published on how the key was obtained, and quotes the provider's characterisation that "This was more sophisticated than a simple compromised username and password" (Infosecurity Magazine, 2026-08-07). A programmatic key is not an account: it does not sit behind multi-factor authentication, does not trip impossible-travel logic, and in a multi-tenant platform it is frequently scoped to the platform rather than to a tenant, which is how a single credential becomes every customer's backup.

Encryption at rest did not close the gap either. Beacon states that while it stores data in an encrypted state, its experts have advised that on the available evidence it is possible the responsible party would have been able to decrypt it before copying it out (Beacon CRM, 2026-08-04). That is the expected outcome when the attacker holds an application-layer credential: the platform decrypts for its own legitimate operations, so a stolen key inherits that ability.

Downstream, individual charities are confirming and notifying separately. Victim Support published its own statement saying the evidence suggests "copies of database back-ups were made and likely downloaded by an unauthorised third party" and that it has reported the incident to the Information Commissioner's Office and the Charity Commission (Victim Support, 2026-08-04). Infosecurity names Myton Hospices, Sheffield Hospital Charity, Priscilla Bacon Hospice Charity and Rowcroft Hospice in the healthcare sector, plus homelessness charity The Clock Tower Sanctuary, with affected data including names, email addresses, telephone numbers and donation records (Infosecurity Magazine, 2026-08-07). No actor has claimed the breach and no leak-site listing has appeared.

Triage: an access-key compromise on a supplier platform produces no telemetry on the customer side at all, that is the defining property, and it is why the detection burden sits with the provider's own audit logging of key usage and egress volume rather than with anything a downstream charity could have seen. Where you operate the platform, the discriminator is the shape of the access, not its credentials: a valid key performing bulk reads or backup retrieval at a volume and hour outside its established pattern, against tenants it has never touched before.

our investigation has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party

you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded

Beacon CRM 2026-08-04

Beacon revealed in its public statement that a compromised access key was used to gain access to its systems.

Infosecurity Magazine 2026-08-07

copies of database back-ups were made and likely downloaded by an unauthorised third party

Victim Support 2026-08-04
incident08 Aug 05:10Zmulti-sourceOpen finding →
Sources: Beacon CRM · Victim Support · Infosecurity Magazine

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • beaconcrm.org1 (33%)
  • infosecurity-magazine.com1 (33%)
  • victimsupport.org.uk1 (33%)
All cited sources (3)