Important Update: Beacon CRM Cyber-Security Incident
Latest update – 12 August 2026
Beacon has provided Faith in Families with a further update following additional forensic investigation by its external cyber-security specialists.
The investigation now indicates that the unauthorised third party exported all data contained within Beacon’s customer database, including attachment files.
Beacon has also confirmed that although the information was encrypted while stored within its systems, the unauthorised third party had valid system credentials. This means that information downloaded from the database would have been decrypted by the system and available to the unauthorised third party in a readable format.
This is a development from the information previously provided by Beacon, which had said that database backups were likely downloaded but that the extent of the information involved could not be confirmed.
Beacon has told customers that its experts are unable to determine which individual objects were accessed or the exact destination of the downloaded information.
However, based on the volume of data transferred during the incident and the total amount of data held within the system, their assessment is now that all data contained within the database was exported.
Importantly, Beacon has stated that there continues to be no indication from its online monitoring that information associated with the incident has been published, disclosed or otherwise misused.
The vulnerability believed to have enabled the unauthorised access has been addressed and Beacon says it has identified no suspicious activity or ongoing unauthorised access since the incident was contained.
Faith in Families is updating our own risk assessment and regulatory response in light of this new information.
We continue to encourage anyone whose information may have been held within Beacon to remain alert to unexpected emails, text messages and telephone calls, particularly communications asking for personal information, passwords or payments.
What happened?
Beacon’s investigation has established that the earliest malicious activity currently identified took place on 27 July 2026.
The probable cause was a compromised access key connected with Beacon’s Amazon Web Services environment.
Beacon’s external cyber-security specialists have identified significant data transfer activity during 27 and 28 July which coincides with the unauthorised access.
Based on the volume of that activity, Beacon’s current assessment is that the unauthorised third party exported all data contained within its customer database.
Beacon informed its customers about the incident on 3 August 2026 and has continued to provide further information as its investigation has developed.
Was my information definitely accessed or downloaded?
Beacon cannot identify exactly which individual records were accessed.
However, its latest forensic assessment is now that all data contained within its customer database was exported.
Because Faith in Families held supporter, donor, fundraising and volunteer information within Beacon at the time of the incident, we are therefore working on the basis that information held within our Beacon account may have been included.
The exact information held about you will depend on your relationship with Faith in Families.
Was the information encrypted?
The information was encrypted while stored within Beacon’s systems.
Beacon has now clarified, however, that the unauthorised third party had valid system credentials. This means information downloaded using those credentials would have been decrypted by Beacon’s systems and available to the unauthorised third party in a readable format.
We have updated our assessment of the incident to reflect this.
Does this include attachments?
Yes.
Beacon’s latest assessment specifically includes attachment files stored within its systems.
Faith in Families is therefore continuing to review the types of documents and attachments held within our Beacon account as part of our assessment of the potential impact on individuals.
Has any Faith in Families information been published or misused?
At present, there is still no evidence that information connected with this incident has been published, disclosed or otherwise misused.
Beacon continues to undertake online monitoring as part of its response.
We will continue to review any information Beacon provides and will update this page if that position changes.
Is there still unauthorised access to Beacon?
Beacon says it has addressed the vulnerability believed to have caused the incident and reset relevant system credentials.
Additional cyber-security monitoring has also been introduced.
Beacon has advised customers that, since the original incident was contained, its security specialists have identified no suspicious activity or ongoing unauthorised access to its AWS environment or engineer systems.
What is Faith in Families doing following this latest update?
We are updating our response to take account of Beacon’s latest findings.
This includes:
updating our formal incident and risk assessment;
reviewing the information and attachments held within our Beacon account;
updating our assessment of the potential impact on supporters and volunteers;
updating the relevant regulatory authorities where required;
keeping our Board informed of developments;
continuing to review our own system access and security arrangements; and
keeping people whose information may have been involved informed as the situation develops.
What should I do?
There is currently no evidence that information has been misused, but we recommend remaining particularly alert to potential phishing or scam communications.
Please take extra care with unexpected emails, calls or text messages, particularly if someone:
appears to know information about you or your connection with Faith in Families;
asks you to confirm personal information;
asks for passwords, banking details or payment information;
asks you to click an unexpected link or open an attachment; or
creates urgency or pressure for you to take action.
If somebody contacts you claiming to be from Faith in Families and you are unsure whether the communication is genuine, please contact us independently using the details on our official website.
What happens next?
Beacon’s forensic investigation is continuing and it expects to provide customers with a final summary once that work has concluded.
There may be some details that Beacon is unable to establish definitively.
Faith in Families will continue to assess any new information we receive and update this page where there is a material change.
This page was last updated on 12 August 2026.
If you have any questions or concerns about this incident or the information Faith in Families holds about you, please contact catrina@faithinfamilies.wales and use “Beacon Data Incident” in the subject line.
The following was the update from 7th August 2026. Please see latest updates at the top of this page:
We want to let our supporters, volunteers, fundraisers, partners and wider Faith in Families community know about a cyber-security incident involving Beacon CRM, one of the systems we use to help us manage our fundraising, supporter and volunteer information.
We know that news about a data security incident can be worrying. We want to be open about what we know, what we don’t yet know, what we are doing in response and what you can do as a sensible precaution.
Beacon informed its customers on 3 August 2026 that an unauthorised third party had gained access to its systems.
Its investigation has since confirmed that copies of customer database backups were made and were likely downloaded.
Beacon has told customers that it is unlikely to be able to establish exactly which individual records or pieces of information were included. Because of this, it has advised organisations using Beacon to take a cautious approach and work on the assumption that information held within their database, including attachments, may potentially have been downloaded.
Faith in Families is now carrying out our own detailed assessment of the information we held within Beacon at the time of the incident and the potential impact on people connected with our charity.
We will keep this page updated as further information becomes available.
Frequently Asked Questions
What is Beacon CRM?
Beacon is a Customer Relationship Management system used by charities and other organisations.
At Faith in Families, we use Beacon primarily to help us manage our relationships with supporters, donors, fundraisers and volunteers.
It helps us keep information organised, record donations and fundraising activity, manage communications and maintain appropriate records about the people and organisations who support our work.
What happened?
Beacon experienced a cyber-security incident in which an unauthorised third party gained access to its systems.
Beacon has confirmed that copies of database backups were created and were likely downloaded.
The company is working with external cyber-security specialists to investigate what happened.
Beacon has identified the probable cause of the unauthorised access, addressed the vulnerability and introduced additional security monitoring.
Beacon has also confirmed that, since the incident was contained, its external cyber-security specialists have not identified any continuing unauthorised access to its systems.
Was Faith in Families specifically targeted?
There is currently nothing to suggest that Faith in Families was individually targeted.
The incident occurred within Beacon’s systems and has affected organisations using the Beacon CRM platform.
Because Faith in Families is one of those organisations, information we held within our Beacon account may potentially have been included in the database backups involved.
Was my information definitely accessed or downloaded?
We don’t know.
This is an important distinction.
Beacon has not been able to tell its customers exactly which individual records were downloaded.
It has therefore advised organisations to take a cautious approach and assume that information stored within their Beacon account at the time of the incident may potentially have been included.
This does not mean we know that your individual record was accessed or downloaded.
What information might Faith in Families hold about me in Beacon?
This depends entirely on your relationship with Faith in Families.
Information may include things such as:
- your name
- email address
- telephone number
- postal address
- the organisation you work for
- records of donations you have made
- fundraising activity
- Gift Aid information
- events you have attended or supported
- volunteer information
- communication preferences
- records of previous contact or engagement with Faith in Families
- notes connected with our relationship with you
- documents or attachments connected with a record, where applicable
This does not mean that we hold all of this information about every person.
We are currently carrying out a detailed review of the information held within our Beacon account, including notes and attachments, so that we can properly assess the potential impact of the incident.
Does this include information about children and families supported by Faith in Families?
Beacon is primarily used by Faith in Families for fundraising, supporter and volunteer management; it is not our main case-management system for the children and families receiving our services.
However, as part of our response to this incident, we are checking the information, notes and attachments held within Beacon so that we can be confident about exactly what information was stored there.
If that review identifies anything that changes our assessment of the risk, we will act on it immediately.
Does this include volunteer information?
Yes, Faith in Families does use Beacon in relation to volunteers, so volunteer records form part of the information we are currently reviewing.
We are looking particularly carefully at what information, notes and attachments have been held in volunteer records so that this can form part of our risk assessment.
Have my bank or card details been compromised?
Beacon has stated that there is currently no evidence that payment card details have been compromised.
Faith in Families does not use Beacon to directly store full payment card details. Online card payments are processed through our payment provider, Stripe, with information about the resulting donation recorded within our CRM.
As part of our wider review, we are also checking our payment integrations and exactly what payment-related information is recorded within Beacon.
If we identify anything that changes this position, we will update this information.
Was the information encrypted?
Beacon has confirmed that information within its systems was stored in an encrypted state.
However, Beacon’s cyber-security specialists have advised that it is possible the unauthorised third party responsible for the incident could have decrypted information before it was copied.
Because of this uncertainty, we are not relying on encryption alone when assessing the potential risk.
Has any Faith in Families information been published or misused?
At present, we have not been made aware of any evidence that information relating specifically to Faith in Families has been published or misused.
Beacon has also stated that, as part of its response, it has been monitoring for information connected with the incident appearing online.
We will continue to monitor the information Beacon provides as its investigation progresses.
Is Beacon safe to use now?
Beacon remains operational.
Beacon says it has addressed the vulnerability believed to have caused the unauthorised access, reset credentials connected with its systems and introduced additional security monitoring.
Its external cyber-security specialists have said they have not identified ongoing unauthorised access since the original incident was contained.
We are also reviewing our own Beacon account, users, passwords, security settings and connections to other applications as part of our response.
What is Faith in Families doing?
We are taking a number of steps.
These include:
- carrying out a detailed review of the information held within Beacon
- assessing what types of personal information may potentially have been involved
- reviewing volunteer records, notes and attachments
- reviewing our users, passwords and system access
- reviewing Beacon integrations and connections with other applications
- assessing the potential risk to the people whose information we hold
- keeping a formal record of the incident and the decisions and actions we take
- considering and acting on our reporting responsibilities with the Information Commissioner’s Office and other relevant regulators
- seeking appropriate IT and data protection guidance
- preparing communications for people who may potentially have been affected
- reviewing how important system and security alerts are received internally so that there is appropriate cover during absence or annual leave
This assessment is ongoing and we will update this page where there is important new information to share.
Do I need to do anything?
There is no need to panic or stop supporting, volunteering or engaging with Faith in Families.
However, there are some sensible precautions everyone potentially affected by a data security incident can take.
Please be particularly alert to unexpected emails, text messages and telephone calls.
Be cautious if somebody:
- asks you to provide personal information
- asks for passwords or financial details
- encourages you to click an unexpected link
- sends you an attachment you were not expecting
- creates urgency or pressures you to make a payment
- claims to be from Faith in Families but their message does not feel quite right
Phishing attempts can sometimes appear convincing because the person contacting you already knows basic information such as your name, email address or the organisation you support.
Knowing something about you does not automatically mean a message is genuine.
Could somebody pretend to be Faith in Families?
This is one of the risks we want people to be aware of.
If contact information has been obtained, it could potentially be used to make a phishing email, text or telephone call appear more convincing.
Faith in Families will never unexpectedly email you asking you to provide your password or full payment card details.
If you receive something claiming to be from us and you are unsure, please don’t use the contact details or links within that message.
Instead, contact Faith in Families independently using the details on our official website.
Do I need to change my passwords?
There is currently nothing in the information provided by Beacon to suggest that passwords belonging to Faith in Families supporters or volunteers have been obtained through this incident.
Beacon users within Faith in Families have been required to reset their Beacon login credentials as part of Beacon’s security response.
As a general cyber-security precaution, it is always good practice to use strong, unique passwords for different online accounts and to use two-factor authentication wherever it is available.
Has Faith in Families reported the incident?
Faith in Families is responsible for assessing the impact of the incident on the personal information we hold.
We are currently working through our reporting obligations and taking appropriate advice, including in relation to the Information Commissioner’s Office and charity regulation.
We will update this information once that process has been completed.
Why didn’t Faith in Families prevent this?
The unauthorised access occurred within Beacon’s systems rather than Faith in Families’ own IT network.
However, the information stored within Beacon belongs to the people who have shared it with us, and Faith in Families remains responsible for taking appropriate steps in response when something like this happens.
That is why we are carrying out our own assessment rather than simply relying on Beacon’s investigation.
We are also looking at what we can learn from this incident and whether there are further changes we can make to strengthen our own processes.
Will you contact me personally?
We are currently assessing the information held within Beacon and the potential level of risk.
Where our assessment identifies that people need to be contacted directly, we will do so.
We are also considering wider communication with our supporters and volunteers because we believe being open about what has happened is important.
What happens next?
Beacon’s investigation is continuing and we expect further information as that work progresses.
Our own assessment is also continuing.
If new information materially changes our understanding of the incident or the possible impact on people connected with Faith in Families, we will update this page and contact people directly where appropriate.
This page was last updated on 7 August 2026.
I have a question or I’m worried about my information. Who can I speak to?
Please contact:
Faith in Families
catrina@faithinfamilies.wales
If you contact us about the Beacon incident, please include “Beacon Data Incident” in the subject line so that we can make sure your enquiry reaches the right person as quickly as possible.
