Sheffield Hospital Charity

Profile narrative

Sheffield Hospital Charity, also known by the alias Sheffield Hospital Charity, is a United Kingdom-based charitable organisation associated with the hospitals in the Sheffield area. The charity operates as part of the broader UK charitable sector and engages in fundraising activities to support hospital services, equipment, patient experience initiatives, and related causes linked to its affiliated hospitals. As a registered charity, it relies on donations and supporter contributions, maintaining records of its donor base to manage communications, fundraising appeals, and administrative processes. The organisation stores supporter information within a customer relationship management (CRM) platform, capturing details such as names, email addresses, telephone numbers, and donation histories to facilitate its engagement with donors and beneficiaries.

The charity was among more than 1500 UK charities affected by a cyber-attack disclosed on 27 July 2026, which targeted its CRM provider, Beacon. The incident was traced to a compromised AWS access key, which allowed the attacker to download all data held in the Beacon platform, including attachment files, over a period of approximately one hour and twenty-seven minutes before detection. Because the data was encrypted at rest but accessed using valid credentials, the attacker was able to decrypt the information during the download. Beacon subsequently reset all related credentials and found no evidence that the attacker maintained persistent access or subsequently misused the stolen data.

In its public response to the incident, Sheffield Hospital Charity confirmed that the compromised dataset contained supporter names, email addresses, telephone numbers, and donation records. The charity clarified that no patient health details, payment card numbers, or bank account information were stored within the affected Beacon system, which limited the sensitivity of the exposed records. Affected charities, including Sheffield Hospital Charity, were advised by Beacon to report the incident to the UK Information Commissioner's Office. The Information Commissioner's Office subsequently deemed Sheffield Hospital Charity not responsible for the underlying breach, as the compromise occurred at the CRM provider rather than within the charity's own infrastructure.

As a charity rather than a commercial or public-sector body, Sheffield Hospital Charity operates within a regulatory environment overseen by the Charity Commission for England and Wales and is subject to UK data protection legislation, including the UK General Data Protection Regulation. The incident highlighted the dependencies that smaller and mid-sized charities have on third-party technology providers for managing donor relationships and the associated risks when those providers experience security incidents. Beyond its public statements concerning the Beacon breach, the available source material does not provide additional quantitative details regarding the charity's size, annual income, staff count, or specific operational footprint, and these details have therefore been omitted rather than estimated.

Incidents

1 incident linked to this organisation.