Update: Final report on Security Incident

Date published: 11 September 2026

Beacon CRM have shared a final update on the recent cyber security incident and published a final report. In summary, the report shares:

• Beacon CRM’s systems are secure and operating normally. There has been no service interruption as a result of this incident.
• Monitoring has found no reference to the cyber security incident or data related to it on the dark web.
• There is no evidence that this was a targeted attack on Beacon CRM, or any specific Beacon CRM customer.
• Beacon CRM have concluded their investigations and passed on everything they have learnt to law enforcement.
• Beacon CRM have told us they have not communicated with the parties responsible for copying the data, but those parties did contact Beacon CRM near the end of the investigation to state that the information copied would not be kept, sold or shared. Beacon CRM have stated they have not responded and their investigation was not influenced by this contact.
• Beacon CRM have used an independent security organisation (who were not part of the investigation) to check their investigation and findings and provide a letter of attestation.
• Beacon CRM have taken steps to strengthen their security including adding, updating and/or reviewing security measures to avoid an incident like this happening again.

If you would like to view a copy of Beacon’s CRM’s report, please click here. You will be redirected to their website.

Date published: Monday 17 August 2026

We are writing to let you know about a cyber security incident involving Beacon CRM, a company that provides a database system we use. We take the privacy and security of your information very seriously.

What is Beacon CRM?

Beacon CRM is a database provider for over a thousand charities including national organisations. St Hilda’s East uses Beacon CRM to store and manage information about people who use our services, as well as our donors and supporters.

What happened?

Beacon CRM recently experienced a cyber security incident. Someone who was not authorised gained access to Beacon’s systems and copied information held in its databases. Beacon CRM has investigated the incident with cyber security experts.

What information may have been affected?

Beacon CRM cannot tell exactly which information was copied. However, based on their investigation, the evidence suggests that all data held in their systems were copied and likely downloaded in a readable format, even though it was encrypted, which is a security measure designed to prevent information from being read. St. Hilda’s is therefore assuming that all data in their systems were affected.

How has Beacon CRM responded?

Beacon CRM took immediate action to secure its systems and prevent any further unauthorised access. It brought in independent cyber security experts to investigate what happened and has taken additional steps to improve the security of its systems.

Beacon is also working with the relevant authorities and monitoring the internet for signs that information from the incident has been published or misused. So far, Beacon has found no evidence that this has happened.

Beacon has identified the likely cause of the incident and has taken action to address it. It has also introduced additional security monitoring and required users to reset their passwords. Beacon has said that there has been no further unauthorised access since the incident was contained, and its services continue to operate normally.

What has St. Hilda’s East done?

We became aware of the incident on Monday 3 August. Although there is currently no evidence that personal information has been misused, we are taking a precautionary approach and treating information held in Beacon CRM as having been copied and read.

We have:

• Treated this as a personal data breach
• Reported the incident to and sought advice from the Information Commissioner’s Office (ICO), the UK’s data protection regulator
• Reported the incident to The Charity Commission
• Been in regular contact with Beacon CRM for further information, and
• Reviewed the information we hold in Beacon CRM to understand the possible risks to the people we work with
• Kept records of the actions we have taken
• Informed all those possibly affected

The security incident happened within Beacon CRM’s systems. St Hilda’s East’s own computer systems and network were not affected by the incident and continue to operate normally.

Beacon has confirmed that it does not store payment card information. However, some records in Beacon contain attachments, and we cannot confirm every piece of information contained within those documents. We are therefore taking the approach that information contained in attachments as affected by the incident.

At present, we are not aware of any fraud, identity theft or other harm resulting from this incident.

What should you do?

We are not currently aware of anyone misusing personal information connected to this incident. However, there is a possibility that someone could use information about you to make a scam email, text message or phone call seem more genuine.

For example, a scammer may appear to know that you have used St Hilda’s East or may know some genuine information about you. Knowing information about you does not mean that the person contacting you is genuine.

As a precaution, we recommend that you:

• Be careful if you receive an unexpected email, phone call or text message asking for personal information or money
• Do not click links or open attachments in unexpected messages unless you are sure they are genuine
• Never give out your passwords, security codes or bank details to someone who contacts you unexpectedly
• Remember that someone knowing genuine information about you does not necessarily mean that they are who they say they are

Further information

• Beacon has published further information about the incident on its website: https://www.beaconcrm.org/incident-faqs
• Hilda’s East has put together a list of organisations that can help. You will be able to view this on our website or pick this up from reception, or at this link.
• If you have any questions or concerns specifically about this incident, please contact St Hilda’s East at [email protected] or call 020 7739 8066.

Yours sincerely,

Daniel Charcharos
Head of Operations
St. Hilda’s East