A cyber-security incident has affected Beacon CRM, a software company that stores and processes data on behalf of clients, including Lincoln Cathedral and Magna Vitae. On Monday, 3 August, Beacon discovered unauthorized access to systems handling personal information, such as names, addresses, email addresses, and phone numbers. While the breach did not involve financial details like payment or bank account data, it still raised concerns among affected organizations.
Details of Beacon CRM's operations
Beacon CRM serves over 1,000 charities and organizations across the UK. It stores a range of personal and operational data, including contact details, event participation, and records tied to engagement with festivals or diversity and inclusion initiatives. Magna Vitae, for instance, uses Beacon to store information about leisure centre users in Skegness, Horncastle, Mablethorpe, and Louth. In response to the breach, the company confirmed no payment data was compromised. Beacon has engaged external cyber-security experts to contain the incident and investigate its cause.
Reactions from Lincoln Cathedral and Magna Vitae
Lincoln Cathedral responded through a statement from its Dean, The Very Reverend Dr Simon Jones, who clarified the breach occurred in a third-party system, not within the cathedral's own IT infrastructure. Magna Vitae issued a warning to users to remain vigilant about suspicious messages, emails, or attachments, despite there being no evidence that data was shared or published online. Both organizations stressed their commitment to protecting personal information and are working closely with Beacon as the investigation unfolds.
Breach reporting and regulatory response
Lincoln Cathedral and Magna Vitae have reported the incident to the Information Commissioner's Office (ICO) as required by law. The ICO has confirmed it is aware of the breach and has received multiple reports from affected organizations. The regulator is in contact with Beacon CRM and is assessing the data breach information. Organizations are legally obligated to report such breaches within 72 hours if they pose a risk to individuals' rights or freedoms.
Beacon CRM stated it has already communicated with all its clients and is focused on supporting them as they address the potential impact of the breach. The company emphasized that its services remain fully functional and that users can access the platform without interruption. Beacon also expressed concern over the incident and said it is handling the matter with the utmost seriousness.
The Very Reverend Dr Simon Jones reiterated the cathedral's commitment to protecting personal data, even though the breach was in a third-party system. Magna Vitae mentioned that records for users might include event attendance, engagement with SO Festival activities, and diversity-related details, but again, no financial data was at risk. The organizations are cooperating with Beacon CRM and regulatory bodies to ensure the situation is resolved.
Those impacted can learn more about the incident by listening to highlights from Lincolnshire on BBC Sounds or watching the latest episode of Look North. For updates, users are encouraged to download the BBC News app from the App Store for iPhone and iPad or Google Play for Android devices.