Loading story…
Manchester-based HIV charity George House Trust warned service users that attackers may have accessed and downloaded sensitive personal and health-related records from its systems. Exposed information may include contact details, home addresses, and case notes documenting individuals’ engagement with the charity; the organization said it had found no evidence that the data had been published or misused.
The incident was traced to a breach of Beacon, a technology and CRM provider serving more than 1,000 UK charities and non-profits. Beacon said the intrusion occurred at the end of July and notified George House Trust on August 3; the charity subsequently reviewed the breach and alerted affected individuals after identifying sensitive records. The attacker, intrusion method, and number of affected people have not been disclosed, while the wider Beacon incident could affect up to 1,500 charities.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
After reviewing Beacon-held records, George House Trust notified affected users that sensitive personal and health-related information may have been downloaded. Potentially exposed records included contact details, home addresses, and notes about individuals' engagement with the charity; the charity said it had no evidence of publication or misuse at the time.
Beacon notified Manchester HIV charity George House Trust that its database data may have been accessed and downloaded by attackers.
Beacon engaged external cybersecurity experts to contain the incident and investigate its scope, while supporting affected organizations.
Beacon reported that attackers breached its database system at the end of July. The system is used by more than 1,000 UK charities, and the wider incident could affect up to 1,500 organizations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Beacon CRM said a cyberattack exposed data belonging to a significant number of UK charities that use its platform, after attackers copied database backups and likely downloaded them. The company warned customers to assume that **all data stored in Beacon before July 27**, including attachments, was taken, and said the information may be readable even where customer data had been encrypted. Beacon discovered the incident around July 29 and began notifying affected customers on August 3. Early evidence indicates the attackers gained access using compromised credentials, although Beacon has not disclosed how the credentials were obtained or whether extortion demands were made. In response, the company reset all user passwords and tightened password requirements, while affected organizations including the Molly Rose Foundation assessed potential exposure of donor, supporter, and service-user information; Victim Support said its victim data was not affected.
Aug 13, 2026
Beacon disclosed that attackers used a compromised **AWS access key** exposed in publicly accessible JavaScript build artifacts to access its CRM platform and exfiltrate a full copy of customer data. The company said the intrusion targeted its entire customer base of roughly **1,500 UK charities and non-profits**, with malicious activity beginning on July 27 and lasting about **1 hour and 27 minutes**, matching a sharp spike in AWS data transfers. Because the attacker authenticated with valid credentials, data encrypted at rest was reportedly downloaded in readable form. Exposed information may include supporters’ names, email addresses, phone numbers and donation records, affecting charities in sensitive sectors including healthcare and victim support; Beacon said patient data, payment card data and bank account information were not stored in the compromised CRM environment. The company reported no evidence of persistence, rotated AWS-integrated credentials, removed secrets from client-side assets, added security tooling, and notified UK regulators and law enforcement, while affected organizations such as Justice for Colombia and the Center for Sustainable Energy began warning supporters of potential exposure.
Aug 20, 2026
Three Asheville-area skilled nursing and rehabilitation facilities affiliated with Ascent Healthcare Management disclosed that a threat actor accessed systems or accounts between **November 25 and November 28, 2025**, exposing files tied to an unnamed trusted vendor. The affected organizations—**Bear Mountain Health and Rehabilitation**, **Elevate Health & Rehabilitation**, and **Swannanoa Valley Health & Rehabilitation**—said the compromised information included extensive personal data and protected health information, and they began notifying affected residents on **July 31**. The breach was separately reported to HHS, with **1,397**, **1,551**, and **1,045** individuals affected across the three facilities. A Massachusetts template notice reportedly stated that the intrusion involved login credentials stolen from another unnamed trusted vendor, while the facilities told victims there was **"credible evidence"** the stolen files had been permanently deleted and would not be published; that assurance drew scrutiny because of the long gap between the intrusion and notification and the limited transparency around the attackers and access path.
Aug 24, 2026