Database backups likely stolen, potentially exposing donor, supporter, and service user details
Beacon CRM has confirmed it was hit by a cyberattack that exposed data belonging to a growing list of UK charities.The company, which markets its software to charities and has more than 1,500 customers, said its investigation remains ongoing. However, it appears that a substantial amount of customer data was copied, and Beacon is warning users to assume everything they stored on the platform was downloaded."Currently, our investigation has confirmed that copies of database backups were made and likely downloaded by the unauthorized third-party," it said on Tuesday. "We have evidence that shows a spike in activity during the incident timeline symptomatic of data leaving our systems.
"It is highly unlikely we will be able to ascertain any more granular detail regarding exactly what data this was and to whom it relates so out of an abundance of caution, you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded."
Beacon also warned that although customer data is encrypted, "it is possible that the unauthorized third party responsible for this incident was able to decrypt it." Customers should therefore assume the copied information was readable.Beacon did not answer any of The Register's questions, instead offering a statement that echoed the wording of its public FAQ pages.It did not comment on whether extortion demands were made, nor how or when the attackers got in.Beacon's information page says early evidence points to compromised credentials being used to access its systems. One affected charity said the company became aware of the attack on July 29.Beacon also said anyone with a paid account or free trial created before July 27 should assume that all data stored in it was downloaded.While the incident response folk do their thing, customers have been urged to investigate how badly they were affected. Beacon also reset every user's password and imposed stronger requirements on replacements.Charities hitBecause Beacon CRM is a product specifically engineered for the charity sector, the bulk of those confirmed to be affected are UK charities.
