We know this may feel like a long time to have waited, so it is worth setting out the dates plainly.
Beacon became aware on 29 July 2026 that it may have experienced a cyber-security incident. It did not inform SCA UK until the afternoon of 3 August.
Since then we have secured our account and reset our passwords, worked through what information was actually involved and who it belongs to, taken advice, and reported the incident to the Information Commissioner’s Office and the Charity Commission. We have also been pressing Beacon for specific answers about what was taken, which we are still waiting on.
We could have written to you sooner with very little in it. We would rather have told you something accurate than something fast.