Information about a recent data incident

05/08/2026

On Monday, we were notified that Beacon’s systems, which are used by more than 1,500 charities, has been affected by a cyber security incident.

As a result, some personal information relating to supporters of those charities may have been accessed. At this stage, there is no evidence that any information has been misused. However, we believe it is important to be open and transparent with our community, so we wanted to let you know about the incident as soon as possible and explain the steps we are taking in response.

We would like to reassure you that no financial information, including payment card details, is stored within Beacon’s systems. This means that no payment or banking information has been affected by this incident.

We understand that this news may be concerning, and we are truly sorry for any worry or inconvenience it may cause.

What happened?

On the afternoon of Monday 3 August, Beacon CRM notified charities of a cyber security incident affecting its systems. Beacon has engaged specialist cyber security experts to investigate the incident and is continuing to assess its impact.

What information might be affected?

The information we hold about individuals varies depending on the nature of their relationship with us and the information they have chosen to provide. As a result, our records may contain some, or in limited cases all, of the following information:

• Name

• Address

• Phone number

• Email

• Donation history and Gift Aid status

• Names of babies in whose memory donations or fundraising has taken place 

What are we doing?

Protecting your personal information is extremely important to us. As soon as we were notified of the incident, we took immediate steps to understand its potential impact and respond appropriately. We have:

• Reviewed the information that may have been affected.

• Completed Beacon CRM's recommended security checklist.

• Assessed the potential risks to the individuals whose information we hold.

• Reported the incident to the Information Commissioner's Office (ICO).

• Reported the incident to the Charity Commission

• Continued to monitor the situation and remain in contact with Beacon CRM as its investigation progresses.

What happens next?

We will continue to monitor the situation closely and remain in contact with Beacon CRM while its investigation is ongoing. If we receive any new information that changes our assessment or means you need to take any action, we will contact you as soon as possible.

Is there anything you need to do?

At this stage, we believe the risk to individuals is low. However, we recommend remaining vigilant for any phishing emails, scam text messages or suspicious phone calls.

Please be cautious of any unexpected communications, particularly those asking you to confirm personal information or take urgent action. Before clicking on links or opening attachments, make sure they are genuine, and never share passwords, verification codes or financial information in response to unsolicited requests.

How will I know if a communication from Aching Arms is genuine?

We understand you may have questions about how to recognise genuine communications from Aching Arms following this incident. The information below explains the types of contact you may receive from us and when you should be cautious.

Emails
We send a monthly newsletter, as well as occasional emails about fundraising events, campaigns, appeals and updates from the charity.
If you are a healthcare professional, you may receive emails from one of our Volunteers who helps coordinate the delivery of Aching Arms bears and to your organisation. If you want to verify the identity of your local volunteer contact, please contact our team at info@achingarms.co.uk

Phone calls
Aching Arms does not make unsolicited phone calls asking for donations.
We may occasionally contact existing supporters by phone, for example to discuss an event you for or another aspect of your involvement with the charity.

Letters
We do not send unsolicited letters. However, we may write to existing supporters or send fundraising materials by post.

Text messages and WhatsApp
If you have given us permission to contact you in this way, we may occasionally send text message or WhatsApp about fundraising activities or other relevant charity updates.

If you are unsure
If you ever receive a communication claiming to be from Aching Arms and are unsure whether it is genuine, please do not respond, click on any links, or share any personal information until you have verified it.
You can contact us at digitalcomms@achingarms.co.uk and we'll be happy to help confirm whether the communication is legitimate.  

Thank you for the trust you place in Aching Arms and for your continued support. We never take that trust for granted, and we are deeply sorry for any concern or inconvenience this incident may cause. We remain committed to protecting your personal information and will keep you informed as we learn more.

If you have any concerns or questions, please email us at digitalcomms@achingarms.co.uk. 

Leanne - CEO & Founder at Aching Arms.

« Back to News