Loading story…
Beacon disclosed that attackers used a compromised AWS access key exposed in publicly accessible JavaScript build artifacts to access its CRM platform and exfiltrate a full copy of customer data. The company said the intrusion targeted its entire customer base of roughly 1,500 UK charities and non-profits, with malicious activity beginning on July 27 and lasting about 1 hour and 27 minutes, matching a sharp spike in AWS data transfers. Because the attacker authenticated with valid credentials, data encrypted at rest was reportedly downloaded in readable form.
Exposed information may include supporters’ names, email addresses, phone numbers and donation records, affecting charities in sensitive sectors including healthcare and victim support; Beacon said patient data, payment card data and bank account information were not stored in the compromised CRM environment. The company reported no evidence of persistence, rotated AWS-integrated credentials, removed secrets from client-side assets, added security tooling, and notified UK regulators and law enforcement, while affected organizations such as Justice for Colombia and the Center for Sustainable Energy began warning supporters of potential exposure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-13, The Survivor’s Trust said the UK Information Commissioner’s Office had reviewed its case and concluded the charity bore no responsibility for the Beacon breach. The charity also urged supporters to stay alert for scams.
On 2026-08-12, Beacon disclosed through CTO David Simpson that a compromised AWS access key exposed in public JavaScript build artifacts likely enabled the theft of its CRM data. Beacon said the attacker used valid credentials, making encrypted-at-rest data readable when downloaded.
Reporting on the Beacon CRM breach identified additional affected organizations, including GuildCare, Saints Foundation, and Full Fact, alongside previously named charities. The organizations were described as notifying impacted individuals and assessing what data in their Beacon environments was exposed.
Affected charities and reporting on Beacon’s incident said the breach impacts all of Beacon’s more than 1,000 customer organizations. This expanded the known scope of the incident across UK charity and nonprofit users of Beacon’s CRM platform.
Beacon's investigation identified a major increase in AWS data downloads and transfer between July 27 and July 28, 2026, matching the volume of stored records and attachments. This activity aligned with the suspected exfiltration window.
Beacon said the earliest malicious activity began on 2026-07-27 at 01:20:16 UTC after an exposed AWS access key was used to authenticate to AWS. The activity lasted about 1 hour and 27 minutes, and investigators concluded the attacker exported the full customer database and attachment files.
Downstream charities publicly warned supporters that personal information and donation histories may have been compromised through the Beacon breach. Named organizations included The Survivor’s Trust, Shrewsbury and Telford Hospital Charity, the British Deaf Association, Yorkshire's Brain Tumour Charity, Justice for Colombia, and the Center for Sustainable Energy.
Beacon reported the incident to UK regulators and law enforcement, with the Information Commissioner’s Office, the Charity Commission, and Action Fraud becoming involved. Beacon also advised affected charities to assess and fulfill their own notification obligations.
After the breach, Beacon revoked and rotated AWS-integrated credentials, removed sensitive build parameters from client-side JavaScript, and deployed additional security tooling including endpoint detection and SentinelOne Cloud Native Security. Beacon also said it found no evidence of persistence in its environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceteiss.co.uk
Open sourcecybersecuritynews.com
Open sourceinfosecurity-magazine.com
Open sourcebeaconcrm.org
Open sourcelawcare.org.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Beacon CRM said a cyberattack exposed data belonging to a significant number of UK charities that use its platform, after attackers copied database backups and likely downloaded them. The company warned customers to assume that **all data stored in Beacon before July 27**, including attachments, was taken, and said the information may be readable even where customer data had been encrypted. Beacon discovered the incident around July 29 and began notifying affected customers on August 3. Early evidence indicates the attackers gained access using compromised credentials, although Beacon has not disclosed how the credentials were obtained or whether extortion demands were made. In response, the company reset all user passwords and tightened password requirements, while affected organizations including the Molly Rose Foundation assessed potential exposure of donor, supporter, and service-user information; Victim Support said its victim data was not affected.
Aug 13, 2026
The Crimson Collective, a newly identified advanced persistent threat (APT) group, has been observed targeting Amazon Web Services (AWS) environments to steal sensitive data. Security researchers have reported that the group specializes in exploiting leaked AWS Identity and Access Management (IAM) keys, which are often sourced from exposed code repositories or misconfigured cloud environments. Using tools like TruffleHog, the attackers systematically search for and validate AWS credentials that have been inadvertently published or left unprotected. Once a valid access key is identified, the group leverages the GetCallerIdentity API call to confirm its usability and gain initial access to the victim's AWS account. The attackers then establish persistence by creating new IAM users, login profiles, and additional access keys, effectively embedding themselves within the compromised environment. To maximize their control, Crimson Collective attaches the AWS-managed AdministratorAccess policy to these new accounts, granting themselves full administrative privileges. In scenarios where immediate administrative access is not available, the group uses the SimulatePrincipalPolicy API to analyze existing permissions and identify pathways for privilege escalation. This methodical approach allows the attackers to conduct extensive reconnaissance, manipulate cloud resources, and exfiltrate sensitive data without detection. The group’s operations demonstrate a sophisticated understanding of AWS’s internal mechanisms and highlight the risks associated with overly permissive IAM policies. Victims of these attacks face significant threats, including data theft, extortion, and potential disruption of cloud-based services. The incident underscores the importance of securing access credentials, regularly auditing IAM policies, and monitoring for unusual API activity within cloud environments. Security experts recommend immediate revocation of exposed keys, implementation of least-privilege access models, and the use of automated tools to detect credential leaks. The emergence of Crimson Collective signals an escalation in targeted attacks against cloud infrastructure, emphasizing the need for robust cloud security practices. Organizations are urged to review their AWS configurations and ensure that sensitive credentials are never stored in public or unsecured locations. The attack chain employed by Crimson Collective serves as a cautionary example of how mismanaged cloud security can lead to severe breaches. Ongoing investigations aim to determine the full scope of affected organizations and the extent of data exfiltration. The cybersecurity community continues to monitor the group’s activities and share indicators of compromise to help defend against similar threats. This incident highlights the evolving tactics of APT groups in targeting cloud environments and the critical need for proactive defense measures.
Jul 12, 2026
A misconfigured Elasticsearch server, believed to be operated from Russia or a Russian-speaking country, was discovered leaking over 6.19 billion records to the public internet without any authentication or password protection. The exposed server contained a massive trove of 1.12 terabytes of data, including records collected from both disclosed and undisclosed data breaches, as well as information obtained through website scraping. Among the most sensitive data found were records from Ukrainian bank Accordbank, which included users’ full names, birthdates, birthplaces, addresses, phone numbers, national ID numbers, passport numbers, and tax codes. Independent cybersecurity researcher Anurag Sen was the first to identify the exposed server and report its existence to the media. The server’s index information confirmed the scale of the exposure, with over 6.19 billion records available for anyone to access. Screenshots from the server revealed that the data was stored in JSON format and included detailed personally identifiable information (PII) from various sources. The database also contained files referencing Accordbank, which were later observed being peddled by the user "tRex_Prime" on DarkForums, indicating that the data may have already been accessed and distributed by other threat actors. The leak included not only banking and contact information but also records from other breaches and data scraped from websites, making the exposure particularly broad and damaging. The server was eventually taken offline, but it remains unclear how long the data was accessible or how many unauthorized parties may have downloaded the information. Previous incidents involving hacking groups such as ShinyHunters and Nemesis were also mentioned, as they had leaked stolen data and hacking tools from other exposed cloud storage resources in the past. The incident highlights the ongoing risks associated with misconfigured cloud infrastructure and the potential for large-scale data aggregation to amplify the impact of breaches. Security experts warn that such exposed databases are prime targets for cybercriminals seeking to exploit PII for identity theft, fraud, and further attacks. The presence of both old and new breach data, as well as scraped information, demonstrates the evolving tactics of threat actors in collecting and monetizing sensitive information. Organizations are urged to regularly audit their cloud configurations and monitor for unauthorized data exposures to prevent similar incidents. The scale and sensitivity of the leaked data underscore the urgent need for improved security practices in managing large datasets, especially those containing PII from multiple sources. The incident serves as a stark reminder of the consequences of failing to secure cloud-based data storage and the far-reaching impact such exposures can have on individuals and organizations worldwide.
Jul 12, 2026