Beacon CRM confirms full database theft after AWS access key breach

Key Takeaways

• Beacon CRM, a platform serving over a thousand UK charities, confirmed a full database theft.
• The breach originated from a compromised AWS access key inadvertently exposed in public-facing JavaScript build artifacts.
• An attacker exfiltrated the entire customer database and attachment files in readable form due to valid credential use bypassing encryption.
• The incident occurred on July 27-28, 2026, with the attacker active for approximately 1 hour and 27 minutes.
• Regulatory bodies, including the UK Charity Commission and ICO, are involved, and affected charities are notifying their constituents.

Full Database Exfiltration Confirmed at Beacon CRM Following AWS Key Breach

Beacon, the customer relationship management (CRM) platform widely used by over 1,000 UK charities and non-profit organizations, has officially confirmed that an unauthorized actor successfully copied and exfiltrated its entire customer database.

This critical disclosure, issued by Chief Technology Officer David Simpson on August 12, 2026, significantly clarifies and escalates previous statements regarding the extent of the security compromise.

Investigations conducted by Beacon, in collaboration with external cybersecurity experts, traced the root cause of the intrusion to a compromised Amazon Web Services (AWS) access key. This sensitive credential was discovered within publicly accessible JavaScript build artifacts hosted directly on the company’s website.

Such credential leaks commonly occur when automated software build processes inadvertently embed environment variables or secret keys into client-side code. This allows anyone inspecting the website’s assets via a web browser to easily extract them. This vulnerability often fuels credential harvesting campaigns and automated scans targeting exposed cloud infrastructure.

Breach Details and Data Exfiltration

As detailed in the official report published by Beacon CRM, forensic analysis of AWS Cost and Usage reports from May to July 2026 revealed a substantial surge in data transfer on July 27 and 28, 2026. Key findings include:

• Initial Access: Malicious activity was first detected on July 27, 2026, at 01:20:16 UTC.
• Intrusion Window: The attacker maintained access for approximately 1 hour and 27 minutes before the compromised access was revoked.
• Exfiltration Volume: A dramatic spike in data transfer volume precisely matched the total size of stored platform records, leading investigators to conclude that the entire database and all associated attachment files were exported.

A crucial aspect of this breach involved the behavior of cloud storage encryption when valid credentials are stolen. Despite Beacon maintaining data encryption at rest within its AWS environment, the adversary authenticated using a legitimate, albeit stolen, AWS access key. Since AWS automatically decrypts data for authorized credential holders, the storage-level encryption offered no protection once the key was compromised. Consequently, the exfiltrated database records and file attachments were downloaded in a fully readable format.

The swift trading of such exposed secrets on illicit markets underscores why long-lived API keys pose a persistent and significant cloud security risk.

Investigators found no evidence that the threat actor established persistent backdoors or secondary points of access within Beacon’s infrastructure. Following the incident, Beacon implemented several critical remediation steps:

1. Credentials Rotated: All AWS-integrated access keys and secrets were revoked and subsequently rotated.
2. Exposure Mitigated: Sensitive build parameters were removed from client-side JavaScript assets to prevent future exposure.
3. Enhanced Telemetry: Endpoint detection tools, alongside SentinelOne Cloud Native Security, were deployed across all enterprise environments and engineer workstations to bolster monitoring and threat response capabilities.

The breach has prompted involvement from several regulatory bodies, including the UK Charity Commission, the Information Commissioner’s Office (ICO), and Action Fraud. Impacted non-profit organizations, such as Justice for Colombia and the Center for Sustainable Energy, have begun the process of notifying their supporters that personal information and donation histories may have been exposed.

Beacon has confirmed that continuous monitoring of the dark web has not yet revealed any evidence of the stolen database being sold, published, or held for ransom. The company advises affected client organizations to independently assess their data notification obligations as a final investigative report is being prepared.

What You Should Do

• For Organizations Using Cloud Services: Implement robust secret management practices. Never embed sensitive credentials directly into client-side code or public repositories.
• Implement Least Privilege: Ensure AWS access keys and other cloud credentials have only the minimum permissions necessary for their intended function.
• Regularly Rotate Credentials: Establish a strict schedule for rotating all API keys and access credentials, especially those with elevated privileges.
• Monitor Cloud Activity: Utilize cloud native security tools and SIEM solutions to continuously monitor for unusual data transfer volumes, access patterns, and API calls.
• Educate Developers: Train development teams on secure coding practices and the risks associated with exposing credentials in build artifacts or source code.
• Review Public-Facing Assets: Regularly scan your public websites and repositories for inadvertently exposed sensitive information, including API keys and configuration files.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.