Beacon CRM Data Security Incident

Beacon, the third-party system SCA UK uses to hold information about our members, supporters, donors and contacts, has suffered a cyber-security incident. An unauthorised third party gained access to Beacon’s systems and exported all of the data held in its database. This happened at Beacon, not at SCA UK.

Beacon is used by more than 1,000 UK charities, and this incident is not specific to SCA UK. Beacon has brought in external cyber-security specialists and its investigation is continuing.

What Happened

Beacon became aware on 29 July 2026 that it may have experienced a cyber-security incident. On 12 August 2026 it published the findings of its investigation.

Beacon says the probable cause was a compromised Amazon Web Services access key, which it believes may have been exposed in publicly accessible JavaScript files on its own site. Using that key, an unauthorised third party accessed Beacon’s systems in the early hours of 27 July 2026. The earliest activity Beacon has identified so far began at about 1.20am UTC and lasted around an hour and a half. Beacon’s assessment is that the attacker exported all of the data held in its database. Beacon’s data is encrypted where it is stored, but because the attacker had valid credentials, that encryption did not prevent the data being read.

Beacon has told us that its monitoring has so far found no indication that any of the information has been published, disclosed or misused, and that no ransom has been demanded. It has reported the incident to the Information Commissioner’s Office and to Action Fraud.

Beacon informed SCA UK on the afternoon of 3 August 2026. It has advised all its customers to assume that the information stored in their accounts, including attachments, may have been involved. Beacon has said there is currently no evidence that the information has been published or misused, and no ransom has been demanded.

We know that this may feel like a long time to have waited. Beacon became aware on 29 July but did not tell us until the afternoon of 3 August. We have used the days since to secure our account, establish what information was actually involved, take advice, and report the incident to the Information Commissioner’s Office and the Charity Commission. We would rather have told you something accurate than something fast.

What Information May Be Involved

If you have never donated to SCA UK, never been in touch with us, and are not a member (Friend Of) or a volunteer, your information is not held in this system.

What we hold varies from person to person, depending on how you have been involved with SCA UK. It may include:

• your name;
• your email address, postal address and telephone number;
• records of donations you have made, including amounts and dates, and donations made through JustGiving;
• your Gift Aid status, if you have made a declaration;
• membership, volunteering, event or meet-up information;
• copies of emails between you and SCA UK, which are kept on your record; and
• in a small number of cases, information about your health that you have shared with us.

Not all of these will apply to everyone. Beacon’s assessment is that all of the data in its database was exported, so if your details were in our Beacon account before 28 July 2026 you should assume they were included. We can’t even confirm that any SCA UK records have been downloaded or viewed, but we have chosen to inform you out of an abundance of caution.

Being Straight With You

We want to be honest about the part of this that may matter most to you. Because of what SCA UK is, appearing on our list may in itself suggest that you or someone close to you has had a cardiac arrest. That is private information, and not everyone has shared it widely.

Beacon has seen no evidence that any of this information has been published anywhere, and criminals in incidents like this are usually looking for money rather than reading individual records. But we would rather tell you plainly than reassure you further than we honestly can.

What SCA UK Has Done

Protecting the information you have trusted us with matters a great deal to a charity like ours. Since being notified, we have:

• disconnected and reconnected every system linked to Beacon, and reset all our passwords;
• followed Beacon’s immediate security recommendations;
• reviewed the information held in our account and assessed the risks to the people it belongs to;
• reported the incident to the Information Commissioner’s Office and to the Charity Commission;
• briefed our trustees, who are being kept updated;
• followed the information and community activity of other Beacon users closely, so that we benefit from what the wider charity sector is learning about this incident; and
• asked Beacon for specific answers about exactly what was taken, which we are continuing to press for.

We will also contact directly anyone we believe may be more affected than most.

What We Suggest You Do

We are not aware of any misuse of anyone’s information. As a sensible precaution, though, we would suggest that you:

• are wary of unexpected emails, telephone calls, text messages or social media messages, particularly any that use your name and appear to know about your connection to SCA UK, or that claim to be from Beacon;
• do not click links or open attachments in messages you were not expecting;
• never give out a password, a verification code or bank details in response to a message that came to you;
• check that your email password is strong and not used anywhere else; and
• are careful with claims companies. You may be approached by firms offering to pursue compensation on your behalf. That is entirely your decision, but check who you are dealing with before giving anyone your personal or financial details.

How to Spot a Suspicious Message

A scam message can look convincing, and it may contain details that are perfectly correct. Take extra care if you notice any of the following.

Frequently Asked Questions

Select a question below to read the answer.

Further Information

Beacon has published its own updates and answers on its incident FAQs page. The Information Commissioner’s Office has advice for people who have been told about a data breach, and the National Cyber Security Centre has guidance on recognising and reporting phishing emails, texts and calls.

Questions or Concerns

We will update this page whenever Beacon gives us anything significant to share, and we will change the date at the top when we do.