Beacon

Profile narrative

Beacon, also referenced under the alias "Beacon," is a United Kingdom-based organisation that operates a customer relationship management (CRM) platform used by the charity sector. The platform serves charities across a broad spectrum of causes, including healthcare-related and victim support organisations, indicating that Beacon's primary market is the UK non-profit and charitable sector rather than commercial enterprises. Services provided through the platform appear to centre on enabling charities to manage donor and supporter information, as evidenced by the categories of data it holds, such as names, email addresses, telephone numbers, donation records, and attached files relating to donor communications and casework. The organisation's role is therefore that of a third-party data processor, handling personal information entrusted to it by its charity clients in the course of their fundraising, outreach, and case management activities.

The scale of Beacon's reach is reflected in the breadth of impact recorded in a single security incident, where over 1500 UK charities were affected by unauthorised access to data held on its systems. While this figure relates specifically to the exposure of customer data rather than a stated headcount or revenue, it does suggest that Beacon's CRM platform has substantial adoption within the UK charity ecosystem and supports organisations operating in sensitive service areas such as healthcare and victim support. The platform does not store payment card numbers, bank account details, or sensitive patient data, which is a relevant structural and operational attribute distinguishing it from CRM providers handling financial or special category health information. Beacon's regulatory positioning is that of a data processor subject to UK data protection law, and its customers have been advised to notify the UK Information Commissioner's Office following the breach, indicating alignment with established UK data protection reporting obligations.

A notable distinguishing attribute of Beacon is its specialisation in serving the charity sector, a market segment with distinct operational, regulatory, and data-handling requirements compared to commercial CRM deployments. The organisation's exposure to charities operating in sensitive areas such as healthcare and victim support places particular emphasis on the protection of personal data, even where that data does not rise to the level of special category information under data protection legislation. The prompt does not provide explicit information regarding Beacon's ownership structure, parent entities, or subsidiary relationships, and accordingly no such details are asserted here. Similarly, the organisation's founding date, employee count, and precise geographic footprint beyond the United Kingdom are not confirmed in the available material and are therefore omitted rather than inferred. Beacon's documented exposure of an AWS access key within public JavaScript build artifacts points to a configuration and software supply chain dimension to its operations, in which build artefacts intended for client-side distribution inadvertently contained infrastructure credentials, an issue that subsequently enabled the documented incident and that is relevant to understanding both its technical posture and the nature of the data exposure affecting its charity clients.

Incidents

1 incident linked to this organisation.