Loading story…
Beacon CRM said a cyberattack exposed data belonging to a significant number of UK charities that use its platform, after attackers copied database backups and likely downloaded them. The company warned customers to assume that all data stored in Beacon before July 27, including attachments, was taken, and said the information may be readable even where customer data had been encrypted. Beacon discovered the incident around July 29 and began notifying affected customers on August 3.
Early evidence indicates the attackers gained access using compromised credentials, although Beacon has not disclosed how the credentials were obtained or whether extortion demands were made. In response, the company reset all user passwords and tightened password requirements, while affected organizations including the Molly Rose Foundation assessed potential exposure of donor, supporter, and service-user information; Victim Support said its victim data was not affected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
ITV News Channel reported that ten charities in the Channel Islands disclosed data breaches tied to the Beacon CRM cyber incident, expanding the known set of affected organizations beyond those already named. This represents a further victim disclosure linked to the same Beacon compromise.
Guild Care said Beacon informed it of the incident on August 3 and disclosed that names, email addresses, and organizational information held in Beacon may have been affected; it began notifying impacted contacts and assessing whether to report the incident to the UK ICO. The British Deaf Association, Saints Foundation, and Full Fact also reported being affected by the Beacon CRM breach.
Beacon CRM started notifying affected customers on August 3. The Molly Rose Foundation said Beacon informed it of the breach that day.
Beacon CRM became aware of the breach around July 29, according to affected-customer statements and subsequent reporting. Early evidence indicated the attackers accessed Beacon systems using compromised credentials.
Beacon CRM warned that anyone with a paid account or free trial created before July 27 should assume all data stored in Beacon before that date, including attachments, was downloaded by an unauthorized third party and may be readable despite encryption.
Victim Support, identified among affected charities using Beacon CRM, stated that no victim data was impacted by the incident.
The Molly Rose Foundation said personal data belonging to supporters, donors, and service users was affected, including names, addresses, email addresses, phone numbers, genders, dates of birth, and donation or payment records.
Beacon CRM publicly confirmed a cyberattack affecting customer data from UK charities, said database backups were copied and likely downloaded, and advised customers to assume all stored platform data may have been compromised. The company also reset all user passwords and imposed stronger password requirements while its investigation continued.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceitv.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Betterment** disclosed that a **social engineering** attack against a **third-party platform account** used for customer communications enabled unauthorized access to internal systems in early January, leading to the exposure of personal data tied to **1,435,174 accounts**. The intruder used the access to send **fraudulent crypto-themed promotional messages** impersonating Betterment and promising to “triple” cryptocurrency sent to attacker-controlled wallets (including **Bitcoin and Ethereum** addresses). Betterment said it revoked the unauthorized access the same day it was detected, warned customers to ignore the messages, and initiated a forensic investigation with external incident-response support. Breach analysis and indexing by **Have I Been Pwned** indicated the exposed dataset included **email addresses, names, and location data**, with reporting also citing additional PII such as **dates of birth, physical addresses, phone numbers, device information, and employment-related details**. Betterment stated there is **no evidence** that customer investment accounts were accessed or that **passwords/authentication tokens** were compromised, characterizing the incident as an exposure of contact/identity data rather than account credentials. Separate reporting noted Betterment also experienced **intermittent outages attributed to a DDoS attack and extortion attempts** around the same period, but this was described as distinct from the social-engineering-driven data exposure.
Jun 29, 2026
Capita said a March ransomware attack attributed to **Black Basta** compromised its Microsoft 365 environment and led to the theft of personal data from employees, customers, and clients. The outsourcing firm acknowledged that data was exfiltrated from less than **0.1%** of its server estate, but the impact spread widely because Capita provides services to many organizations. Reporting indicated that customer data was stolen, and Capita notified affected customers, suppliers, and staff while working with forensic specialists and expanding remediation and security investments. The breach triggered broad fallout across the UK. About **90 organizations** reported personal data breaches to the Information Commissioner’s Office, and regulators contacted more than **300 pension funds** to assess possible exposure. The Universities Superannuation Scheme warned that details for roughly **470,000** members may have been compromised, including names, dates of birth, National Insurance numbers, and pension membership numbers. Capita later said the incident would cost **£20 million to £25 million**, and by its annual results said the cyberattack had contributed to a loss of more than **£106 million**.
Jun 29, 2026
Craneware, a U.K.-based healthcare software company whose products are used by more than 2,000 U.S. hospitals and nearly 10,000 clinics and retail pharmacies, disclosed that attackers breached a subset of its internal data environment and exfiltrated employee, customer, and business partner information. The company said unauthorized individuals viewed and copied a significant volume of file names tied largely to non-sensitive or publicly available regulatory data, but confirmed that some sensitive corporate records were also taken. The company said the intrusion has been contained and that the attackers no longer have access, with no disruption reported to Craneware operations or the hospital services it supports. Craneware said it activated its incident response plan, brought in external cybersecurity and forensic investigators, and notified the FBI and the U.K. Information Commissioner’s Office, while continuing to determine the full scope of the breach and whether any additional impacted data sets are involved.
Jul 22, 2026