What happened
A compromised AWS access key is the likely root cause of an attack on CRM provider Beacon that has exposed personal information held by around 1,500 UK charities. The company said in an incident update on 12 August that the key was potentially exposed in public JavaScript build artifacts, suggesting a development error. Beacon assessed that the attacker used the valid credentials to access and download all data contained within its CRM platform, including attachment files, affecting its entire customer base of charitable organisations. The stolen data covers charities working in highly sensitive sectors such as healthcare and victim support. Although information was encrypted at rest in AWS, the valid credentials allowed the threat actor to retrieve it in readable form. Beacon’s review of AWS Cost & Usage reports places malicious activity on 27 July beginning at 01:20:16 UTC and lasting about one hour and 27 minutes, a window that lines up with a sharp rise in data downloads on 27 to 28 July. Beacon said it has found no evidence of persistence in its environment. Customers have been advised to report the incident to the UK Information Commissioner’s Office; The Survivor’s Trust confirmed on 13 August that the ICO had reviewed its case and concluded the charity bears no responsibility for the breach.
Technical details
The incident centers on the leakage of a long-lived AWS access key that was made reachable from the public internet through JavaScript build artifacts shipped with Beacon’s front-end. Beacon’s own assessment describes the exposure as likely stemming from a development-time misconfiguration that left the key in client-side code rather than confining it to server-side secrets management. Once the key was retrievable by anyone inspecting the published build, it provided the attacker with authenticated access to the AWS account backing the CRM platform. With the valid credentials in hand, the threat actor was able to query the services that store the CRM data and retrieve objects, including attachment files, directly from AWS. Because the key was legitimate, AWS decrypted data on read as part of normal service operation, so encryption at rest did not impede exfiltration. Beacon’s cost and usage telemetry shows a concentrated burst of download activity aligned with the authenticated session window, consistent with bulk retrieval across the customer tenant store. No CVE is associated with the disclosure and Beacon has not published a formal vulnerability identifier, IAM policy scope, or proof-of-concept artefacts.
Who is affected
The breach reaches across Beacon’s entire UK customer base, with the provider assessing that roughly 1,500 charities were impacted by the theft of data from its CRM platform backed by AWS. The customer set is described as charitable organisations spanning health care and non-profit support work, with confirmed public disclosures naming hospital and hospice charities alongside disability and brain tumour charities. Named organisations that have announced compromises include Shrewsbury and Telford Hospital Charity, the British Deaf Association, Yorkshire’s Brain Tumour Charity, Sheffield Hospital Charity, Priscilla Bacon Hospice Charity, the Clock Tower Sanctuary and Victim Support. The material taken is supporter-level records held by the charities in Beacon’s tenant store. Reporting on the incident update lists names, email addresses, telephone numbers and donation histories among the types of personal information thought to be exposed. Because the records relate to donors and service users of charities operating in sensitive areas such as healthcare and victim support, the exposure carries heightened privacy risk for individuals already in vulnerable circumstances. With the data in the hands of an unauthorised actor, charities warn of downstream misuse risk. The combination of identifying details and giving history is assessed as useful for targeted social engineering and phishing, with The Survivor’s Trust urging supporters to remain alert to potential scams in the weeks following disclosure.
What to do
Defenders who rely on SaaS CRM data stored in AWS should treat the Beacon incident as a prompt to audit how long-lived AWS credentials are created, distributed and surfaced in software builds. The provider said the access key was potentially exposed in public Javascript build artifacts, an error that points to development pipeline hygiene rather than an external compromise of AWS itself. Organisations should scan repositories and published build outputs for embedded secrets, enforce secret-management controls in CI/CD, and ensure that any credential used by front-end code or client-side bundles is removed at build time. Where keys must be used by services that retrieve objects and attachments from S3, the principle of least privilege should be applied with tightly scoped IAM policies and short-lived credentials issued via IAM Roles Anywhere or STS rather than static long-lived keys. Detection should focus on the behaviour Beacon observed in its AWS Cost & Usage telemetry: a concentrated burst of download activity aligned with an authenticated session window. Security teams can baseline normal S3 GET volume and object sizes per tenant and alert on sustained spikes, unusual geographic access, or downloads outside business hours. Enabling and centralising CloudTrail logging for S3 data events, S3 server access logs and IAM key usage, and correlating those logs with cost and usage reports makes it easier to spot bulk retrieval that would be consistent with the roughly one hour and 27 minute window reported for the malicious activity that began on July 27. Automated revocation playbooks for compromised keys should be tested so rotation can be completed without manual delays. Beacon said it has reset all credentials for services and accounts integrated with AWS. Affected charities are warning supporters about the risk of targeted social engineering and phishing using names, email addresses, telephone numbers and donation histories. Organisations should coordinate notifications with their vendor, preserve forensic evidence from cloud logs, and provide clear, sector-appropriate guidance to donors on recognising impersonation attempts in the weeks following disclosure.
Key points
- Beacon identified a compromised AWS access key as the likely root cause of the attack, with the key potentially exposed in public JavaScript build artifacts.
- The attacker used valid credentials to access and download all data in the CRM platform, including attachments, impacting its entire 1,500-strong customer base of charities.
- Malicious activity was identified from AWS Cost & Usage reports as beginning on July 27 at 01:20:16 UTC and lasting approximately one hour and 27 minutes.
- Data was encrypted at rest in AWS but was decrypted by AWS using valid credentials and available in readable form to the threat actor.
- Beacon advised charity customers to report the breach to the UK ICO, with The Survivor’s Trust confirming the ICO found the charity holds no responsibility for the breach.
Further reading & sources
- Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charit - Infosecurity Magazine — Infosecurity Magazine