Exposed AWS Key Enabled Theft of Beacon CRM Backups Affecting Over 1,000 Charities

Unknown attackers stole database backups from Beacon CRM, a UK platform serving more than 1,500 nonprofit and charitable organisations, using an AWS access key exposed in publicly accessible JavaScript build artifacts. The downloads occurred on 27–28 July 2026 and exposed records belonging to more than 1,000 UK charity customers. Stolen information included contact details, donation histories, Gift Aid declarations and user notes. The affected database did not store payment card numbers or live bank details.

Beacon detected the activity on 29 July, revoked the exposed credentials and notified affected organisations between 30 July and 3 August. Some charities reported that the backups contained historical records and information previously requested for deletion, extending the exposure beyond current customer data. The breach creates phishing, social-engineering and identity-fraud risks for affected individuals and underscores the need for SaaS providers and customers to review secrets management, least-privilege backup access, retention and deletion practices, and third-party incident response procedures.