Data Breach at Beacon CRM Affects Cultural Organizations

• •Beacon CRM experienced a cyber incident with unauthorized access to database backups.
• •Compromised credentials were used, and sensitive data may have been downloaded.
• •Affected organizations are advised to notify stakeholders and assess their reporting obligations.

Beacon CRM, a customer relationship management platform used by many cultural organizations, reported a cyber-security incident involving unauthorized access to its database backups. The breach, identified on July 29, 2026, involved compromised credentials that may have allowed attackers to download copies of sensitive data. Affected organizations include the English National Ballet and Chiswick House and Gardens Trust, which are notifying their stakeholders about the potential exposure of personal information. While there is no evidence of data being published or misused, the incident raises concerns about phishing attacks using the compromised data. Beacon is conducting a forensic investigation and has advised its clients to assess their data protection obligations. The Information Commissioner’s Office (ICO) has been informed, and organizations are urged to report the breach if it poses a risk to individuals' rights and freedoms.