Beacon CRM Breach Hits 1,000+ Charities via AWS Key
Over 1,000 UK charities had supporter data exposed after attackers used an AWS access key found in Beacon's public JavaScript build artifacts.
airgap 1,000+ charities. One leaked AWS access key. July 27–28, it was used.
What Happened
Beacon, a UK-based CRM provider serving the charity sector, disclosed on August 14 that attackers accessed its AWS environment using a compromised access key. Beacon’s updated investigation finding: the key “may have been exposed in publicly available JavaScript build artifacts.”
Timeline:
- July 27: Earliest observed malicious activity.
- July 27–28: Data transferred out of the AWS environment.
- Early August: Initial breach disclosure to affected charities.
- August 14: Updated investigation findings published.
Confidence: Breach confirmed by the vendor. Root cause attributed to exposed credential; investigation ongoing.
Scope
- Impacted: 1,000+ charities and non-profit organizations using Beacon’s platform.
- Data exposed: supporter PII — names, email addresses, phone numbers, postal addresses.
- Not exposed: financial data. Beacon states no bank account numbers, sort codes, card numbers, or card security details were stored on the platform.
Several UK charities have issued public statements. The UK Charity Commission is monitoring the situation and has issued guidance to affected organizations.
Attribution
No group has claimed responsibility. No evidence of published data as of this writing. Beacon’s own investigation hit limits: “Specific objects, exact destination of the downloads, and definitive attribution…cannot be determined from available logs.”
Unknown actor. Unknown destination. Supporter data is somewhere — and so far, no one can say where. Treat affected individuals’ records as actively staged for phishing until evidence says otherwise.
Root Cause
AWS access key exposed in public JavaScript build artifacts. Known failure mode — secrets bundled into client-side JS at build time, visible to anyone reading page source or diffing release archives. This one was found and used.
If you operate SaaS on AWS and ship JavaScript to users: audit your build artifacts for embedded credentials. Automated secret scanners exist for this. Run them before an attacker does.
Also this week: Trezor discloses 14,000-customer breach via logistics partner ShipMonk — a different vector, same class of supply-chain exposure.
Found this useful? Share it.
