A Leaked Password Let Hackers Drain the Donor Databases of More Than 1,000 UK Charities
Beacon, a software company that helps charities manage their supporters, left an access key exposed in public code. Criminals found it, used it, and likely walked off with every record in the system.
Key points
- Hackers stole data from Beacon CRM, a UK company whose software is used by more than 1,000 charities and non-profit organisations.
- The earliest malicious activity was detected on 27 July 2025, with data transferred on 27 to 28 July.
- Criminals likely used a leaked AWS access key (a digital password for cloud storage) found in publicly visible code to enter Beacon's systems.
- Personal information including names, phone numbers, email addresses, and postal addresses may have been taken; no bank or payment card details were stored on the system.
- The UK Charity Commission is monitoring the situation and has issued guidance to affected organisations.
Beacon is a cloud-based CRM, meaning software that runs on the internet and helps organisations keep track of their donors, volunteers, and fundraising. It is built specifically for the charity sector and, until recently, was quietly doing that job for more than a thousand non-profits across the United Kingdom.
On 27 July, criminals broke in. By the morning of the 28th, they had almost certainly taken a copy of every database Beacon held.
How did the hackers get in?
They used a leaked AWS access key. AWS, which stands for Amazon Web Services, is the cloud computing platform, basically a rented collection of servers and storage, that Beacon used to run its systems. An access key is a string of characters that acts like a password, letting software connect to that cloud environment automatically.
Beacon's investigation found that key had likely been left inside publicly available JavaScript build artifacts. Build artifacts are the packaged files a software team produces when they compile and publish their code. Leaving a secret credential inside one is a well-known and painfully common mistake. Anyone who downloaded or inspected those files could have read the key and used it to walk straight into Beacon's AWS environment, no phishing, no malware required.
The failure mode here is straightforward: a secret was treated as if it were not secret.
What was taken, and should supporters be worried?
Beacon assessed that the criminals exported all data held in the database. Affected charities have confirmed the stolen records can include supporter names, phone numbers, email addresses, and postal addresses.
The good news, and it is genuinely good news, is that Beacon does not store bank account numbers, sort codes, or payment card details. Financial data sitting with payment processors elsewhere was not involved.
The data was encrypted, meaning scrambled to be unreadable, but Beacon acknowledged the attackers may have decrypted it before taking it. In practice that means affected individuals should treat their contact details as exposed.
If you have donated to or volunteered with a UK charity in recent years, watch for unsolicited calls or emails that seem to know your name and charity involvement. That kind of personalised approach is exactly what fraudsters do with freshly stolen contact lists. If something feels off, contact the charity directly using a number from their official website.
| Detail | What the investigation found |
|---|---|
| First malicious activity | 27 July 2025 |
| Data transfer window | 27 to 28 July 2025 |
| Entry method | Compromised AWS access key |
| Key exposure point | Public JavaScript build artifacts |
| Estimated scope | All data across the system |
| Customers affected | More than 1,000 charities |
No known criminal group has claimed responsibility. As of Beacon's latest update, the stolen data has not appeared online. The UK Charity Commission is monitoring and has issued guidance for affected organisations.
One thing the post-mortem will say: rotate your secrets, scan your build artifacts, and treat exposed credentials as breached the moment they leave your control.
