Important Information About a Potential Data Security Incident

As soon as Beacon became aware of the incident, they engaged external cyber security specialists to investigate and secure their systems. As National Energy Action uses Beacon to store supporter and donor information, some of the data we hold may have been affected. We wanted to inform you as soon as possible while investigations continue.

The information held within Beacon may include:

• Name
• Address
• Telephone number
• Email address
• Organisation name (where applicable)
• Donation history and amounts
• Gift Aid declarations

Importantly, we do not store any sensitive personal information, payment card details or banking information within Beacon. All payments are processed through separate, secure payment systems, which have not been affected by this incident.

It is also all important to note that no client data is saved within the Beacon CRM system and therefore is not affected by this incident.

At this stage, Beacon’s investigation is ongoing and we do not yet know whether any personal data has been accessed or misused. However, we believe it is important to be open and transparent with our supporters while further enquiries are carried out.

It is important to note that this incident is not unique to National Energy Action and affects organisations across the charitable sector that use Beacon’s CRM platform.

Beacon has advised that it is taking a number of steps to investigate and manage the incident, including:

• Conducting a comprehensive forensic investigation with external cyber security experts;
• Working with law enforcement agencies and relevant regulatory bodies where appropriate;
• Undertaking online monitoring as part of its incident response activities. To date, no evidence of misuse has been identified;
• Implementing additional precautionary security measures to further protect its systems.

National Energy Action is working closely with Beacon and monitoring the situation carefully. Should we receive any information indicating that your personal data has been affected in a way that presents a risk to you, we will contact you directly with further guidance.

As a precaution, we recommend remaining vigilant for any unexpected emails, phone calls or messages that ask for personal information. National Energy Action will never contact you asking for passwords, payment information or bank account details.

We sincerely apologise for any concern this may cause and thank you for your understanding. Protecting the information entrusted to us is extremely important, and we are committed to keeping you informed as more information becomes available.

If you have any questions or concerns, please contact us at dpofficer@nea.org.uk.

Yours sincerely,

Danni Barnes
Deputy Chief Executive
National Energy Action