Important Information – Beacon

Beacon Cyber Security 

[First published Tuesday 4 August. Updated Thursday 13 August]

What has happened? 

On Monday 3 August, National Energy Action was informed by Beacon, our customer relationship management (CRM) provider, that it had become aware of a potential cyber security incident affecting its systems. 

Beacon is an independent organisation whose CRM platform is used by more than 1,000 charities across the UK. Following discovery of the incident, Beacon engaged external cyber security specialists to investigate and secure its systems. 

As National Energy Action uses Beacon to store supporter and donor information, some of the data we hold may have been affected. We are sharing this information with you as part of our commitment to being open and transparent while investigations continue. 

What information may be affected? 

The information held within Beacon may include: name, address, phone number, email address, organisation name (where applicable), donation history and amount, and Gift Aid declarations. 

Does this affect my payment card or bank details? 

No. 

National Energy Action does not store payment card details or banking information within the Beacon CRM system. All payments are processed through separate, secure payment systems, which have not been affected by this incident. 

Does this affect National Energy Action client data? 

No. 

National Energy Action does not store client data within the Beacon CRM system. Client information is therefore not affected by this incident. 

Has my personal information been accessed? 

At this stage, Beacon’s investigation is ongoing and we do not yet know whether any personal data has been accessed and there is no evidence of any misuse.  

We will continue to monitor the situation closely and will share further information as soon as it becomes available. 

Is National Energy Action the only organisation affected? 

No. 

This incident is not unique to National Energy Action and may affect organisations across the charitable sector that use Beacon’s CRM platform. 

What is Beacon’s response? 

Beacon has advised that it is taking a number of steps to investigate and manage the incident, including: 

• Conducting a comprehensive forensic investigation with external cyber security experts. 

• Working with law enforcement agencies and relevant regulatory bodies where appropriate. 

• Undertaking online monitoring as part of its incident response activities. To date, no evidence of misuse has been identified. 

• Implementing additional precautionary security measures to further protect its systems. 

• More information from Beacon can be accessed here: https://www.beaconcrm.org/incident-faqs  

What is National Energy Action doing? 

National Energy Action is working closely with Beacon and monitoring the situation carefully. 

If we receive information indicating that your personal data has been affected in a way that presents a risk to you, we will contact you directly and provide further guidance. 

What should I do? 

As a precaution, we recommend that you remain vigilant and be cautious of any unexpected emails, phone calls or messages requesting personal information. 

Please remember National Energy Action will never ask you: 

• your passwords. 

• your payment card information. 

• your bank account details. 

If you receive any suspicious communications claiming to be from National Energy Action, please do not respond and contact us directly. 

Has any misuse of data been identified? 

At present, Beacon has advised that it has found no evidence of misuse as part of its ongoing monitoring activities.  

How will I be kept informed? 

We are committed to keeping our supporters informed as more information becomes available. 

Should the investigation identify any risk to your personal data, we will contact affected individuals directly with further information and guidance. 

Who can I contact if I have questions? 

If you have any questions or concerns, please contact: 

Data Protection Officer
dpofficer@nea.org.uk 

We sincerely apologise for any concern this situation may cause and thank you for your understanding and continued support. Protecting the information entrusted to us remains extremely important to us.