As of 7 August 2026, the Charity Commission said it was aware of a recent cyber security incident involving Beacon's Customer Relationship Management (CRM) service and the potential impact on charities that use it. The Commission said it had been actively monitoring the situation and was in contact with the Information Commissioner's Office, which it described as the lead regulator for upholding information rights and data protection law in the UK.

A number of affected charities had submitted serious incident reports to the Commission, which encouraged trustees to keep following its guidance on serious incident reporting. That guidance covers incidents that result in or risk significant harm, loss or damage to a charity, its beneficiaries, assets, services or reputation. The Commission warned that, given the expected volume of such reports alongside other incoming reports, responses were likely to take longer than usual while it prioritised the greatest risks.

The Commission encouraged trustees to consult its guidance on dealing with cyber crime and the ICO's guidance for organisations, and to consider reporting obligations to other regulators and to individuals whose data is stored on Beacon systems on their charity's behalf. It said many Beacon customers had moved promptly to inform supporters, and added that any significant updates would be posted on the page.