George House Trust, the Manchester HIV charity founded in 1985, has confirmed that "sensitive and personal" health information belonging to its service users was downloaded by attackers, and has begun notifying those affected. The breach did not originate at the charity itself. It came through Beacon, a third-party CRM platform used across the UK charity sector, which was compromised at the end of July 2026 using stolen credentials. The BBC, which has seen the notification email sent to George House Trust users, reports the incident potentially affects up to 1,500 charities nationwide, while Beacon's own description to the BBC characterises its customer base as "more than a thousand charities." No count of affected George House Trust individuals has been published, and the charity has said it is unclear how many of its people are involved.
What Happened
The timeline is consistent across the charity notifications published to date, with one point of variance on the intrusion date itself. Beacon told the BBC the breach occurred "at the end of July." Trust Links dates the underlying cyber security incident to 29 July 2026, and the Beaumond House Hospice Care write-up carried by gtachina.org also gives 29 July. Every source that names a notification date agrees on the next step: Beacon informed its customer charities on Monday 3 August 2026.
Beacon says it "immediately engaged external cyber security experts to help contain the incident and investigate," and it has been supporting affected organisations since. Trust Links reports that Beacon has now "addressed the security vulnerability, reset relevant credentials, and implemented additional security monitoring and controls."
George House Trust confirmed it was told by Beacon on 3 August, but did not notify its own service users until roughly three weeks later. The charity told the BBC it waited until it had a "fuller understanding" of what had happened before contacting people, and that it had conducted a review of the data Beacon holds on its behalf. That delay is the most contested judgement call in this incident, and it is worth stating plainly: for a cohort whose HIV status is the data at risk, three weeks of silence is a long time, even when the motive is accuracy rather than concealment.
The downstream charity statements show how differently organisations have handled the same supplier notification. Green Light Trust went public on 6 August and confirmed it had reported the matter to both the Information Commissioner's Office and the Charity Commission. Chiswick House & Gardens Trust emailed supporters on 4 August. The Green House published on 11 August, stating candidly that Beacon had not confirmed its data was directly affected but that it was disclosing anyway. Trust Links and Beaumond House Hospice Care have issued their own notices.
What Was Taken
Beacon's guidance to customers, as relayed by Green Light Trust, is blunt: assume that all data stored within the system may have been accessed. Chiswick House & Gardens Trust was told the same, that all information stored in its database including uploaded files could potentially have been affected, and that Beacon had not yet confirmed exactly which individual records were accessed or downloaded.
For George House Trust specifically, the notification email seen by the BBC lists addresses, email addresses, telephone numbers, and "notes and records" about a user's engagement with the charity. In the context of an HIV support organisation, that engagement record is the sensitive payload. The identity of the data subject as a George House Trust service user is itself health information, regardless of what the free-text notes contain.
Other affected charities describe similar categories. The Green House lists names, addresses, emails, phone numbers and lived experience data. Green Light Trust says its records may include contact details, engagement history, programme participation and related correspondence, and that "for some individuals, this may also include information relating to health, wellbeing, or personal circumstances." Chiswick House & Gardens Trust, a fundraising rather than a clinical use case, lists donation dates and amounts, Gift Aid information, payment-method descriptions and transaction references.
On volume, the sources give no record count at all. What varies is the scope of affected organisations: the BBC frames it as "up to 1,500 charities across the UK" and separately notes Beacon "operates a database system used by more than a thousand charities." Treat 1,000 to 1,500 organisations as the reported range, with no publicly confirmed figure for individual data subjects.
Two consistent negatives are worth recording. Card and bank details do not appear to be in scope: Chiswick House & Gardens Trust states its Beacon records contain no bank account numbers, sort codes, full card numbers or card security details, Green Light Trust says no payment details are stored on Beacon, and Beaumond House says card payments run through separate specialist providers. And as of the latest statements, no source reports publication, misuse, or dark web listing of the data. Green Light Trust adds that no ransom demand has been received.
Why It Matters
This is a supplier breach with a victim profile that makes it materially worse than the data categories alone suggest. HIV status is special category data under UK GDPR, and unauthorised disclosure carries consequences that credit monitoring does not address: outing, family and employment fallout, and in some cases physical risk. The absence of payment data is close to irrelevant here.
The structural lesson is the one the sector has been slow to internalise. The Green House's statement is unusually honest about it, noting that it performed due diligence on Beacon including security arrangements, UK data protection compliance and ISO/IEC 27001 alignment, and that "even organisations with robust security controls can become the target of increasingly sophisticated cyber-attacks." Vendor assurance is not a control. When 1,000-plus organisations concentrate their beneficiary records in one shared platform, that platform's credential hygiene becomes every one of those organisations' risk, and no amount of pre-contract questionnaire work changes the blast radius.
The pattern also generalises beyond the charity sector. Obsidian Security's advisory on the Klue Salesforce compromise, an entirely separate incident from June 2026, documents the same shape: attackers stole a trusted integration's OAuth tokens and used them to bulk-extract CRM records across multiple downstream enterprise tenants, with login activity that looked legitimate to every victim organisation. Different mechanism, identical outcome. The trusted middle layer between organisations and their data is now a primary target, and downstream victims have almost no telemetry with which to detect it.
For completeness, the claimdepot.com item on The Health Trust in San Jose describes an unrelated 2025 incident involving a different organisation and a Qilin ransomware claim. It shares no infrastructure or actor attribution with the Beacon breach and should not be read as connected.
The Attack Technique
Beacon's account, as relayed through multiple customer notifications, is consistent. Chiswick House & Gardens Trust was told an unauthorised person gained access to Beacon's systems "using compromised credentials." The Beaumond House write-up gives the same cause. From there, copies of Beacon's database backups were made, and Beacon believes they were likely downloaded. Trust Links puts it as Beacon's investigation having "concluded that an unauthorised individual likely accessed and downloaded a copy of its customer database."
Note the hedging in the primary account. Beacon says the backups were "likely" downloaded, not confirmed exfiltrated. George House Trust's own notification to its users is firmer, telling them the material had been downloaded by hackers but not published. That gap between supplier caution and charity notification is normal for an investigation still in progress, but defenders should read the exfiltration as probable rather than proven.
No threat actor has been named. No ransomware deployment is described in any source, no ransom demand has been reported, and no leak site listing has surfaced. The reference to a fixed "security vulnerability" alongside credential compromise, in the Trust Links statement, leaves open whether initial access was purely credential-based or chained with a platform flaw. The sources do not resolve this.
What Organizations Should Do
-
Inventory where beneficiary and special category data actually lives. If your CRM, case management or donor platform is hosted by a third party, that supplier's compromise is your notifiable breach. Map which vendors hold health, sexuality, immigration, safeguarding or other special category fields, including free-text notes, which are routinely the most sensitive and least inventoried data in any CRM.
-
Enforce phishing-resistant MFA and conditional access on every SaaS admin and integration account. Compromised credentials were the reported entry point here. Password-only or SMS-backed access to a platform holding a thousand organisations' records is not defensible. Require FIDO2 for administrative roles and restrict admin sessions by network and device posture.
-
Treat backups as a first-class exfiltration target. The stolen asset in this incident was database backups, not the live database. Apply the same encryption, access control, egress monitoring and alerting to backup stores that you apply to production, and alert on bulk backup reads by any principal.
-
Audit and rotate integration tokens and API credentials on a schedule. The Klue case shows the same outcome achieved through a stale OAuth token instead of a password. Enumerate every connected application against your CRM, revoke what is unused, and alert on integration-account logins from infrastructure inconsistent with the vendor's known footprint.
-
Write supplier breach notification terms into contracts and rehearse them. Beacon notified customers within days, but the downstream notification spread from 4 August to late August. Define a maximum supplier-to-you notification window, and pre-draft your own service user communications so the review phase does not become the delay. UK organisations should also confirm their ICO 72-hour reporting position, as Green Light Trust did alongside its Charity Commission report.
-
Brief affected individuals on the specific threat, not generic advice. Trust Links and Green Light Trust both correctly warn about unsolicited contact and point to NCSC phishing guidance. For a cohort whose HIV status may be in attacker hands, add explicit warnings about extortion and blackmail attempts referencing that status, and provide a route to report such contact to the charity and to police.
Sources: Manchester HIV charity has 'sensitive' health data stolen | Beacon CRM Cyber Security Incident - The Green House | Information about Beacon Data Breach - Trust Links | Chiswick House & Gardens Trust data hacked - Chiswick Calendar News | Cyber Security Incident Affecting Beacon CRM - Green Light Trust | Hospice Data Breach: What Happened at Beaumond House? (Cyber Attack... | The Health Trust Data Breach: Personal and Health Information Exposed | The Trusted Integration That Wasn't: Inside the Klue SaaS Supply Ch...