Breaches · 45 days ago
Beacon said on August 12 that a compromised AWS access key was the likely root cause of the breach affecting data from about 1,500 UK charities. The key may have been exposed in public JavaScript build artifacts, and Beacon says the attacker used it to access and download all data in its CRM platform, including attachment files.
The key point is simple: the records were encrypted at rest in AWS, but a valid AWS credential tells the cloud to decrypt and serve the data to that caller. So the problem was not breaking encryption; it was leaking a trusted login path in software delivery.
For teams that publish build artifacts or front-end bundles, the exposure sits in the pipeline as much as in the app. If a cloud key escapes into public code deliveries, encryption on the storage layer may still leave the data readable to whoever found it first.
2 sources covering this story
Over 1,000 Charities Hit by Beacon CRM Data Breach
The root cause of the incident is believed to be a compromised AWS access key that was exposed in publicly available JavaScript build artifacts.
Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charit
CRM provider Beacon has revealed that a compromised AWS access key was the likely root cause of the breach of 1500 UK charities’ data
Part of the PlainSec briefing for 2026-08-15