Beacon CRM, a customer relationship management platform used by more than 1,000 UK charities and non-profit organisations, has confirmed that an attacker copied and exfiltrated its entire customer database following the compromise of an Amazon Web Services (AWS) access key.
The updated disclosure, issued by Chief Technology Officer David Simpson on August 12, 2026, significantly expands on Beacon’s earlier statements.
A forensic investigation conducted with external cybersecurity specialists determined that the compromised cloud credential enabled unauthorised access to platform data and attachment files stored in the company’s AWS environment.
Beacon CRM Data Breach
The key had been exposed in publicly accessible JavaScript build artifacts hosted on Beacon’s website. This type of exposure can occur when build processes mistakenly embed environment variables, API keys, or other secrets into front-end code.
Once deployed, the files can be retrieved and inspected by anyone, including automated scanners searching for leaked cloud credentials. Such exposures create a direct path to cloud compromise.
Threat actors routinely scan public web assets and source repositories for access tokens, keys, and configuration data, then validate discovered credentials against cloud services.
Exposed secrets can also be reused in credential-focused phishing operations and traded through criminal marketplaces. Beacon’s official incident report states that investigators examined AWS Cost and Usage reports covering May through July 2026.
The review identified an exceptional increase in data-transfer activity on July 27 and 28, matching the approximate size of Beacon’s stored records and attachments.
The company reported that the earliest malicious activity occurred at 01:20:16 UTC on July 27. The attacker retained access for roughly one hour and 27 minutes before Beacon closed the intrusion path.
Forensic evidence indicated that the adversary exported the complete database and associated file attachments rather than accessing a limited subset of records. Beacon has not publicly attributed the activity to a named threat actor or group.
The incident also illustrates a central limitation of cloud storage encryption when legitimate credentials are stolen. Beacon stated that its data was encrypted at rest in AWS.
However, the attacker authenticated with a valid AWS access key, allowing AWS services to decrypt the data normally for the authorised session.
As a result, encryption at rest did not prevent the data from being downloaded in readable form. The breach reinforces the importance of short-lived credentials, least-privilege IAM policies, secret-scanning controls, and continuous monitoring of public-facing build artifacts.
Beacon said it has revoked and rotated AWS-integrated access keys and secrets, removed sensitive build parameters from client-side JavaScript assets, and expanded its security telemetry.
The company has deployed endpoint detection tooling alongside SentinelOne Cloud Native Security across enterprise systems and engineer workstations.
Investigators found no evidence that the attacker established persistence, deployed backdoors, or created secondary infrastructure footholds.
Nevertheless, the confirmed bulk export means affected organisations must assess potential exposure of supporter data, donation histories, contact details, and uploaded documents.
The breach has been referred to the UK Charity Commission, the Information Commissioner’s Office, and Action Fraud.
Several Beacon customers, including Justice for Colombia and the Center for Sustainable Energy, have begun notifying supporters about the possible exposure of personal information.
Beacon said its ongoing dark-web monitoring has not identified evidence that the stolen data has been published, sold, or offered in an extortion campaign. The company has advised affected clients to independently evaluate their legal and regulatory notification obligations while its final investigative report is completed.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
 access key.){kind=link}