Beacon Security Incident

I am writing to provide a further update on our investigation into the cyber-security incident we reported to you on Monday.

We have today received a further update from our external cyber security experts on the progress of their investigation which we wish to share with you.

This update confirms their assessment that a copy of the database which holds all Beacon customer data, including attachment files, was made and likely downloaded in a readable format by the threat actor.

Initial access and root cause

The probable root cause of this incident was a compromised AWS access key which was potentially exposed in public JavaScript build artifacts. The earliest malicious activity observed so far occurred on 27 July 2026 at 01:20:16 UTC and lasted for approximately 1 hour and 27 minutes.

Nothing in the ongoing forensic and threat intelligence investigations has identified evidence as to who the threat actor was.

Data exfiltration assessment

Analysis of the AWS Cost & Usage reports across May-July 2026 has been conducted. This data showed a significant increase in data transfer on 27–28 July 2026. This timing correlates with the malicious activity, which supports an assessment that substantial downloads occurred. Specific objects, exact destination of the downloads, and definitive attribution of which objects were accessed cannot be determined from available logs. However, having reviewed the data transfer volume and the total volume of data stored across the system, our assessment is that the threat actor exported all data contained within the database.

The data was encrypted at rest in AWS, but the threat actor had valid credentials and therefore downloads would have been decrypted by AWS and available unencrypted to the threat actor.

There has been no indication from online monitoring that data associated with the incident has been published, disclosed or otherwise misused.

Persistence

No methods of persistence used by the threat actor to maintain access to the AWS environment have been identified.

Having identified the most likely root cause of the unauthorised access, the vulnerability has been remediated and all credentials for services and accounts integrated with AWS reset.

SentinelOne Endpoint Detection and Response (EDR) and Cloud Native Security (CNS) have been deployed across the environment and engineer endpoints to continuously scan for Indicators of Compromise and suspicious activity. Any alerts are being monitored 24/7 and any Indicators of Attack or Compromise identified will be removed automatically. Since containing the initial incident and remediating the likely root cause, no suspicious activity or ongoing unauthorised access to Beacon’s AWS environment or engineer endpoints has been identified.

Whilst we are still awaiting the completion of the investigation, I would like to give you some guidance about what to expect next.

It’s likely there are things we may never be able to find out about this incident. Also, there are some technical details that we won’t be able to share to protect our ongoing security position. We will provide all customers with a summary of the investigation findings once it has concluded in a few weeks, but the level of detail contained in this next and final update may not be any more than the above. I recognise this is frustrating, but unfortunately it is the reality of complex incidents like this. With this in mind, we would recommend making your own risk assessments now regarding onward notification to impacted data subjects using your knowledge of the data you process and store with Beacon. Whilst we can’t advise you on these risk assessments, as they will be unique to the data each customer stores, the team remains available via live chat and email ([email protected]) to help where we can, and we will be keeping our FAQ and Guide pages up to date.

I’d like to thank you for your understanding and patience as we’ve worked through this incident. Keeping your data secure is the most important thing we do at Beacon, and I recognise the serious impact this incident has had on your organisation. Sadly, these types of incidents are becoming more frequent here in the UK, and affect all types of businesses.

Having quickly contained the incident, we have worked with external cyber security specialists to further enhance the comprehensive security measures we already had in place. Longer term in the engineering team, we are committed to continuing to build and update our platform with the very latest cyber security threats front of mind as we look to become a leader in security in our space. We will not be complacent, and will continue to constantly review our security posture to ensure we are doing all we can to protect your data.