Interested in our Cybersecurity Framework?
Visit our article on how to organise an effective cybersecurity strategy to download a copy of our framework.
Ready to Protect Against Data Breaches?
Discover the technologies that safeguard sensitive data and streamline your operations. Learn more today!"
Is your AI properly governed?
Discover how clear policies and oversight can help your organisation use AI responsibly.
Interested in a Free Phishing Security Test?
VirtueUK are partners with KnowBe4, the world's largest security awareness training and simulated phishing platform.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
If you're interested in assessing the Phish-prone percentage of your users, contact us to arrange a free simulated phishing attack.
For charities, a CRM can sit at the centre of almost everything; donor details, supporter communications, fundraising records, volunteer information, service-user data, documents and years of organisational history can all be concentrated within one platform.
That is why the 2026 cyber incident affecting Beacon CRM deserves attention across the charity sector, not only from organisations using Beacon.
The incident demonstrates an uncomfortable truth about modern charity technology: your organisation can take cybersecurity seriously and still be exposed through the systems and suppliers it relies upon.
What happened to Beacon CRM?
Beacon CRM, a CRM provider designed specifically for charities, confirmed that it had suffered a cyberattack involving unauthorised access to its systems. Reporting on the incident said Beacon served more than 1,500 customers.
According to information reported from Beacon’s investigation, copies of database backups were made and were likely downloaded by an unauthorised third party. Beacon advised customers to work on the assumption that data stored within affected accounts, including attachment files, had been downloaded.
Beacon also warned that although customer data was encrypted, it was possible the attacker had been able to decrypt it. Early information pointed towards compromised credentials being used to gain access.
The potential consequences were particularly significant because of the type of information charity CRMs can contain.
For example, the Molly Rose Foundation confirmed that potentially affected information included names, addresses, email addresses, telephone numbers, dates of birth and records relating to donations or payments, among other information. Other charities publicly identified as affected included The Upper Room, Chiswick House and Gardens Trust, Victim Support, Macmillan Cancer Support Jersey, Motiv8 and UK-Med.
This wasn’t simply an IT problem as it quickly became a data protection, governance, operational and reputational issue for the charities involved.
The Charity Commission Responded
The significance of the incident was reinforced when the Charity Commission published specific guidance on 7 August 2026 for charities affected by it.
The Commission said it was actively monitoring the situation and was in contact with the Information Commissioner’s Office (ICO). It also confirmed that a number of affected charities had submitted serious incident reports.
Trustees were encouraged to consider their reporting responsibilities, including whether an incident should be reported to the Charity Commission, the ICO or individuals whose information had been stored within Beacon.
Importantly, the Commission highlighted something that can easily be overlooked during a technical incident: communication matters.
It said clear communication with stakeholders is crucial to retaining trust and protecting the relationships charities depend upon.
The bigger issue: your technology risk extends beyond your organisation
The Beacon incident highlights a challenge facing almost every modern charity which is that a significant proportion of an organisation’s technology no longer sits within its own four walls.
Your CRM may be hosted by one provider, your email sits with another, donations might pass through a separate payment platform, files could be stored in Microsoft 365. Your website, HR software, fundraising tools, marketing platforms and finance systems may each involve different suppliers. All of this creates a digital supply chain.
You may have strong passwords, MFA, cybersecurity policies and staff awareness training internally, but your overall resilience also depends on the organisations entrusted with your systems and information.
This doesn’t mean charities should stop using cloud services, it simply means supplier risk needs to become part of technology governance.
Five questions charity leaders should be asking
The lesson from Beacon isn’t simply “could our CRM be hacked?”
Trustees and senior leaders should be asking broader questions, such as:
1. Do we know where our important data is?
An organisation should understand which systems hold donor, supporter, beneficiary, employee and operational information.
That includes attachments, historical records and archived information, not just the obvious fields within a database.
A useful starting point is a simple data and systems register showing:
- what each platform contains
- who owns it internally
- which supplier operates it
- what integrations connect to it
- how critical it is to the organisation
Without that visibility, assessing the impact of an incident becomes considerably harder.
2. Do we understand our suppliers' security?
Signing a contract shouldn’t be the end of technology due diligence.
For systems handling important or sensitive information, charities should consider security as part of supplier selection and ongoing reviews.
Questions could include:
- What security controls does the supplier operate?
- Does it support MFA and appropriate access controls?
- How is data encrypted?
- How are security incidents communicated to customers?
- What happens to your information when the contract ends?
- What independent security certifications or assessments does the provider maintain?
The goal isn’t to interrogate every supplier as though you are a cybersecurity company, it is simply to understand the risk your organisation is accepting.
3. Could we operate without the system?
Data theft is one concern, availability is another.
If your CRM, finance system or another critical cloud service became unavailable tomorrow, what would stop?
Could fundraising continue?
Could employees access the information they need?
Could supporters still contact you?
Technology resilience should therefore consider both protecting information and maintaining services.
4. Who owns the response?
When a cyber incident happens, there is little time to decide who should be doing what.
Technology teams or providers may investigate the technical problem, but decisions can quickly involve senior management, trustees, communications teams, insurers, legal advisers and regulators.
Your incident response plan should establish those responsibilities before they are needed.
5. When did trustees last discuss technology risk?
Perhaps the most important question is also the simplest.
When was technology risk last meaningfully discussed at board level?
The Charity Commission states that serious incident reporting applies where an incident results in, or risks, significant harm, loss or damage to a charity, its beneficiaries, assets, services or reputation.
Cybersecurity therefore cannot sit exclusively with the person responsible for IT.
Third-party risk needs to be visible
The Beacon incident is a useful reminder that charities increasingly operate within a connected technology ecosystem. A vulnerability or security failure outside your organisation can still create consequences inside it. That makes it important to look beyond individual security products and consider questions such as:
Which suppliers would have the biggest impact on us if they were compromised?
Which systems contain our most important information?
Could we continue operating if one suddenly became unavailable?
Do we know who is responsible for responding?
These questions belong in risk registers, leadership discussions and trustee conversations, not just IT meetings.
Resilience is about being prepared, not being invulnerable
No charity can eliminate cyber risk completely. The more realistic objective is to know where your organisation is exposed, minimise that exposure and have a plan for responding when something goes wrong.
That means understanding your suppliers as well as your own systems, reviewing access and integrations regularly, knowing where important information sits, and ensuring cyber incidents are incorporated into business continuity and leadership planning.
When critical technology is outsourced, the service may belong to a supplier, but the risk doesn’t disappear with it.
For trustees and leadership teams, that makes technology oversight an essential part of building a resilient charity.