The break-in happened at Beacon, not at SCA UK. Beacon is an established system used by more than 1,000 UK charities, and it was chosen for that reason.
That said, the information is ours to look after, and being let down by a supplier does not change our responsibility to the people it belongs to. So we are reviewing what we hold, how long we keep it, and how we assess the security of the organisations we rely on.