An AWS access key "potentially exposed in public JavaScript build artifacts" is the leading suspect behind a July breach at Beacon, a CRM provider for charities and nonprofits, according to the company's first update on the attack in more than a week. The revelation raises questions about why Beacon's development pipeline and code review controls failed to catch the exposed credential. Beacon confirmed that a copy of the database holding all customer data, including attachment files, was made and likely downloaded in readable form by the attacker.
The malicious activity began in the early hours of July 27, 2026, and lasted exactly one hour and 27 minutes, according to Beacon's root cause analysis. Analysis of AWS Cost & Usage reports across May through July 2026 revealed a significant spike in data transfer on July 27-28, 2026, timing that aligns with the malicious activity and supports an assessment that substantial downloads took place. The company serves more than 1,500 customers, though it hasn't established how many had data taken. Beacon's logs can't reveal which specific records left its systems.
CTO David Simpson warned customers that "there are things we may never be able to find out about this incident," and that other details won't be shared to protect Beacon's security position. He said the company's AWS data was encrypted at rest, but the compromised access key may have allowed the attacker to retrieve it in readable form. The attacker established no persistence mechanisms in AWS, according to the company. In an FAQ accompanying the update, Beacon advised customers to assess the likely exposure by reviewing what they stored in their CRM instance.
If the access key was indeed exposed in public build artifacts, it suggests a breakdown in secure development practices that should have prevented credentials from appearing in client-side code. Public JavaScript files are accessible to anyone who visits a website, making any embedded secrets immediately available to attackers scanning for exposed credentials. Many of the charities that have confirmed they're affected have said the data mainly pertains to personal information and details about donations. Since Beacon disclosed the attack on August 4, high-profile charities including Molly Rose Foundation, Macmillan Cancer Support Jersey, English National Ballet, Sheffield Hospitals Charity, the British Deaf Association, and Lincoln Cathedral have joined the list of affected organizations.
Simpson promised to provide customers with a summary when the investigation concludes in a few weeks, but warned that "the level of detail contained in this next and final update may not be any more than" Beacon published on Wednesday. He recommended that customers make their own risk assessments now regarding notification to impacted data subjects using their knowledge of the data they process and store with Beacon. The Charity Commission said that "a number of charities have submitted serious incident reports," and that the volume of these reports is causing delays to responses. The case highlights a tension that security teams face after a breach: transparency helps victims protect themselves, but revealing technical details can expose defensive weaknesses that invite further attacks. Organizations dependent on third-party platforms may need to reconsider how much sensitive constituent data they entrust to external systems without additional safeguards in place.