Beacon CRM Breach Exposes Data of 1,500+ UK Charities via Leaked AWS Key
In late July 2026, Beacon CRM, a UK-based CRM platform used by over 1,500 non-profit and charitable organisations, suffered a supply chain breach that led to the exfiltration of full database backups. Attackers gained initial access using an AWS access key inadvertently exposed in publicly accessible JavaScript build artifacts, then used it over 27–28 July 2026 to download backups covering more than 1,000 UK charity customers. Beacon detected the activity on 29 July, revoked the credentials, and notified affected organisations between 30 July and 3 August, with the UK Charity Commission issuing public guidance. Exposed data included names, emails, phone numbers, home addresses, donation histories, and attachments such as Gift Aid declarations; no payment card or live bank data was stored. Several charities found that records previously requested for deletion were still present in retained backups, extending exposure to historical donors and service users.
Detalhes técnicos
The root cause was a hardcoded/leaked AWS access key embedded in client-facing JavaScript build files, a vector the article notes was also used against Arup Group and Manchester Airports Group, reportedly by the actor FulcrumSec. The overprivileged key allowed direct export of full S3-stored database backups rather than scoped application access, enabling a two-day bulk exfiltration before detection.
Remediação
Recommended mitigations include automating secret scanning in CI/CD pipelines (e.g. GitGuardian, Trufflehog), enforcing least-privilege IAM scoping for build/application keys, maintaining up-to-date third-party SaaS vendor inventories with contractual rapid-notification SLAs to meet the UK ICO's 72-hour reporting rule, and rotating API keys, webhooks, and SSO tokens immediately upon notification of an upstream compromise.
Linha do tempo
-
Beacon CRM Breach Exposes Data of 1,500+ UK Charities via Leaked AWS Key
ler a análise desta fonte ocultar
In late July 2026, Beacon CRM, a UK-based CRM platform used by over 1,500 non-profit and charitable organisations, suffered a supply chain breach that led to the exfiltration of full database backups. Attackers gained initial access using an AWS access key inadvertently exposed in publicly accessible JavaScript build artifacts, then used it over 27–28 July 2026 to download backups covering more than 1,000 UK charity customers. Beacon detected the activity on 29 July, revoked the credentials, and notified affected organisations between 30 July and 3 August, with the UK Charity Commission issuing public guidance. Exposed data included names, emails, phone numbers, home addresses, donation histories, and attachments such as Gift Aid declarations; no payment card or live bank data was stored. Several charities found that records previously requested for deletion were still present in retained backups, extending exposure to historical donors and service users.
Technical Details
The root cause was a hardcoded/leaked AWS access key embedded in client-facing JavaScript build files, a vector the article notes was also used against Arup Group and Manchester Airports Group, reportedly by the actor FulcrumSec. The overprivileged key allowed direct export of full S3-stored database backups rather than scoped application access, enabling a two-day bulk exfiltration before detection.
Remediation
Recommended mitigations include automating secret scanning in CI/CD pipelines (e.g. GitGuardian, Trufflehog), enforcing least-privilege IAM scoping for build/application keys, maintaining up-to-date third-party SaaS vendor inventories with contractual rapid-notification SLAs to meet the UK ICO's 72-hour reporting rule, and rotating API keys, webhooks, and SSO tokens immediately upon notification of an upstream compromise.