Beacon said on August 12 that a compromised AWS access key was the likely root cause of the breach affecting data from about 1,500 UK charities. The key may have been exposed in public JavaScript build artifacts, and Beacon says the attacker used it to access and download all data in its CRM platform, including attachment files.
The key point is simple: the records were encrypted at rest in AWS, but a valid AWS credential tells the cloud to decrypt and serve the data to that caller. So the problem was not breaking encryption; it was leaking a trusted login path in software delivery.
For teams that publish build artifacts or front-end bundles, the exposure sits in the pipeline as much as in the app. If a cloud key escapes into public code deliveries, encryption on the storage layer may still leave the data readable to whoever found it first.