Multiple UK cultural institutions breached through CRM supplier
Attacker 'likely’ stole data – but ‘highly unlikely’ to know what
Customer contact information may have leaked from multiple UK cultural organisations, following a supply chain attack on a widely used CRM provider.
Beacon CRM, which counts animal rescues, NHS charities and museums amongst its clients, says it “became aware” that it “may have experienced a cybersecurity incident” late last week.
On an FAQ page the company writes that “an unauthorised third party gained access to our systems” around the 27th July, probably using compromised credentials.
It is “likely” that the attacker, who has not been identified, exfiltrated Beacon’s database backups. However, it is “highly unlikely” that the company “will be able to ascertain any more granular detail regarding exactly what data this was and to whom it relates.”
Email addresses, business phone numbers and business addresses may have been affected, the CRM provider said in an email to affected customers, although not passwords or payment information.
Beacon has so far been unable to say if the attacker has been able to decrypt the stolen data. It is advising customers be cautious and assume not only that all data stored in its systems has been taken, but that it may have been decrypted.
While Beacon’s customers are wide-ranging, including the British Deer Society, NHS Charities Together and Helen & Douglas House hospice, only a few have released statements confirming they have been affected.
They include English National Ballet (ENB), which in a case of very poor timing was in the process of switching to Beacon CRM during the attack; and Chiswick House and Gardens Trust (CHGT).
ENB warned contacts and organisations it works with to remain vigilant, while CHGT said the information it stored with Beacon included names, contact details, donation dates and amounts and any correspondence on personal records.
The trust added that the information “could potentially be used to make phishing emails, telephone calls or fraudulent requests appear more convincing. It could also lead to unwanted disclosure of your contact details, charitable giving or relationship with Chiswick House and Gardens Trust.”
CHGT has reported the incident to both the Information Commissioner’s Office and the Charity Commission.