System Force IT is sharing important guidance for organisations following a cyber security incident involving Beacon CRM, a customer relationship management platform used by more than 1,500 UK charities.
Beacon became aware of the incident on 29 July 2026, after compromised login credentials were used by an unauthorised third party to access its systems and make copies of database backups.
Charities were notified of the incident on 3 August. Beacon has said it cannot rule out that data was downloaded and is advising customers to assume that everything stored on the platform, including attachment files, may have been taken.
Affected data varies between organisations but can include names, addresses, email addresses, phone numbers, dates of birth and donation or payment records. Organisations already known to be affected include the Molly Rose Foundation, Victim Support and the Scottish Council for Voluntary Organisations.
Why this matters beyond the charity sector
While the incident has affected organisations using Beacon CRM, System Force IT is highlighting the wider lessons for any organisation that relies on third-party platforms to store customer, supporter or business data.
This was a supply-chain breach rather than a direct attack on an individual charity’s own systems, demonstrating the importance of considering the security of the third-party platforms organisations trust with their data.
System Force IT recommends keeping an up-to-date register of third parties holding personal or business-critical data, enforcing multi-factor authentication wherever possible and reviewing the security of vendors before signing up.
Organisations should also have an incident response plan that includes suppliers and ensure employees are trained to recognise potential follow-on phishing attempts, which can use real information exposed through a breach to create more convincing scams.
For organisations using Beacon CRM directly, System Force IT advises reading Beacon’s own customer guidance first and treating this as the primary source of information for their account. Organisations should also consider their reporting obligations and review relevant Data Protection Impact Assessments and Records of Processing Activities.
Reviewing your cyber security
The incident provides an important reminder for organisations to understand who holds their data and to have appropriate measures in place should a third-party supplier experience a breach.
System Force IT provides fully managed IT support and cyber security for businesses across Gloucestershire and the UK, backed by UKAS ISO/IEC 27001 certification.
The team can help organisations review their third-party data processors, MFA coverage and incident response plans to build greater resilience against supply-chain risk.
For further guidance or to arrange a security review, contact System Force IT on 01452 701355.
