Date published: Monday 17 August 2026

We are writing to let you know about a cyber security incident involving Beacon CRM, a company that provides a database system we use. We take the privacy and security of your information very seriously.

What is Beacon CRM?

Beacon CRM is a database provider for over a thousand charities including national organisations. St Hilda’s East uses Beacon CRM to store and manage information about people who use our services, as well as our donors and supporters.

What happened?

Beacon CRM recently experienced a cyber security incident. Someone who was not authorised gained access to Beacon’s systems and copied information held in its databases. Beacon CRM has investigated the incident with cyber security experts.

What information may have been affected?

Beacon CRM cannot tell exactly which information was copied. However, based on their investigation, the evidence suggests that all data held in their systems were copied and likely downloaded in a readable format, even though it was encrypted, which is a security measure designed to prevent information from being read. St. Hilda’s is therefore assuming that all data in their systems were affected.

How has Beacon CRM responded?

Beacon CRM took immediate action to secure its systems and prevent any further unauthorised access. It brought in independent cyber security experts to investigate what happened and has taken additional steps to improve the security of its systems.

Beacon is also working with the relevant authorities and monitoring the internet for signs that information from the incident has been published or misused. So far, Beacon has found no evidence that this has happened.

Beacon has identified the likely cause of the incident and has taken action to address it. It has also introduced additional security monitoring and required users to reset their passwords. Beacon has said that there has been no further unauthorised access since the incident was contained, and its services continue to operate normally.

What has St. Hilda’s East done?

We became aware of the incident on Monday 3 August. Although there is currently no evidence that personal information has been misused, we are taking a precautionary approach and treating information held in Beacon CRM as having been copied and read.

We have:

• Treated this as a personal data breach
• Reported the incident to and sought advice from the Information Commissioner’s Office (ICO), the UK’s data protection regulator
• Reported the incident to The Charity Commission
• Been in regular contact with Beacon CRM for further information, and
• Reviewed the information we hold in Beacon CRM to understand the possible risks to the people we work with
• Kept records of the actions we have taken
• Informed all those possibly affected

The security incident happened within Beacon’s and network were not affected by systems. St Hilda’s East’s own computer systems the incident and continue to operate normally.

Beacon has confirmed that it does not store payment card information. However, some records in Beacon contain attachments, and we cannot confirm every piece of information contained within those documents. We are therefore taking the approach that information contained in attachments as affected by the incident.

At present, we are not aware of any fraud, identity theft or other harm resulting from this incident.

What should you do?

We are not currently aware of anyone misusing personal information connected to this incident. However, there is a possibility that someone could use information about you to make a scam email, text message or phone call seem more genuine.

For example, a scammer may appear to know that you have used St Hilda’s East or may know some genuine information about you. Knowing information about you does not mean that the person contacting you is genuine.

As a precaution, we recommend that you:

• Be careful if you receive an unexpected email, phone call or text message asking for personal information or money
• Do not click links or open attachments in unexpected messages unless you are sure they are genuine
• Never give out your passwords, security codes or bank details to someone who contacts you unexpectedly
• Remember that someone knowing genuine information about you does not necessarily mean that they are who they say they are

Further information

• Beacon has published further information about the incident on its website: https://www.beaconcrm.org/incident-faqs
• Hilda’s East has put together a list of organisations that can help. You will be able to view this on our website or pick this up from reception, or at this link.
• If you have any questions or concerns specifically about this incident, please contact St Hilda’s East at [email protected] or call 020 7739 8066.

Yours sincerely,

Daniel Charcharos
Head of Operations
St. Hilda’s East