Sheffield Hospitals Charity Reports Data Breach Affecting Supporters Sheffield Hospitals Charity, an independent organization raising £2.5 million annually to support NHS hospitals and healthcare services in Sheffield, has disclosed a cybersecurity incident involving unauthorized access to its systems. The breach, detected on Monday, targeted Beacon CRM, the charity’s secure database used to manage supporter information, including names, contact details, donation records, and Gift Aid data. Payment card details were not stored in the affected system. An unauthorized individual gained access using compromised login credentials and downloaded database backups. While there is currently no evidence that personal data has been misused or published, the charity has taken precautionary steps to notify affected individuals. The exact number of people impacted has not been disclosed. The charity has engaged specialist cybersecurity experts to investigate the incident and has reported it to the Information Commissioner’s Office (ICO), Charity Commission, and Gambling Commission. Immediate measures were taken to secure systems and contain the breach. Chief Executive Beth Crackles issued an apology, emphasizing the organization’s commitment to addressing the matter. Sheffield Hospitals Charity operates separately from the NHS and does not hold patient data. However, supporters are advised to remain vigilant against potential phishing attempts or suspicious communications. The investigation into the full scope of the breach is ongoing.

Beacon CRM Data Breach Exposes Charity Supporters’ Information A cybersecurity incident at Beacon CRM, a UK-based customer relationship management provider serving over 1,000 charities, has resulted in unauthorized access to database backups containing customer data. The breach, detected on 29 July, involved attackers using "compromised credentials" to copy sensitive information. Beacon CRM confirmed the incident in a statement, revealing that while immediate containment measures were taken, the breach did not disrupt its services. The company has notified all affected charity clients, regulators, and law enforcement, though it has not disclosed how many organizations’ data was accessed. There is currently no evidence of the stolen data appearing on the dark web or a ransom demand. The Information Commissioner’s Office (ICO) has been alerted, with Beacon advising charities to assess whether the breach poses a risk to individuals’ rights and freedoms potentially requiring them to notify their supporters. At least one charity, The Upper Room, has already contacted donors and volunteers to apologize for the exposure. The incident follows a separate outage at CAF Bank, a subsidiary of the Charities Aid Foundation, which disrupted online banking services from 24 July before being resolved. Investigations into the Beacon CRM breach are ongoing, with cybersecurity experts assisting in determining the full scope of the attack.

UK Charity Sector Hit by Major Cyberattack Targeting Beacon CRM Over 1,000 UK charities, including high-profile organizations like the English National Ballet and the Molly Rose Foundation, have been impacted by a cyberattack on Beacon CRM, a healthcare-focused customer relationship management provider. The breach, which occurred between July 26 and July 31, exposed sensitive data belonging to donors, supporters, and beneficiaries, raising concerns over potential phishing and identity fraud risks. The attack stemmed from human error an employee accidentally leaked an AWS cloud storage access key, which cybercriminals exploited to infiltrate Beacon CRM’s systems and exfiltrate data. While initial assessments suggest payment information was not compromised, the stolen data may include contact details, making affected individuals vulnerable to targeted phishing campaigns. Beacon CRM has notified authorities, including the Information Commissioner’s Office (ICO), and is working to contain the breach. The incident underscores the growing cybersecurity threats faced by organizations relying on cloud infrastructure, particularly those handling large volumes of personal data. Investigations are ongoing to determine the full scope of the exposure and the number of individuals affected.