Hugs takes the protection of your information extremely seriously. We are therefore writing to let you know about a cyber-security incident involving one of our trusted service providers, Beacon CRM, which we use to manage our supporter database. We are sorry to be sharing this news. We know this will be concerning to all. We want to reassure you that we’re taking it seriously and that your safety is our utmost priority. From what we know so far, there is a possibility that some personal information stored within Beacon’s systems may have been accessed without permission. However, there is currently no evidence to suggest that any of this information has been misused.
What has happened?
Our database provider, Beacon have told us that on 29 July 2026, they discovered unauthorised access to their systems, caused by compromised login credentials. Their investigation is ongoing with the support of specialist cyber-security experts and we are being updated on a regular basis on their findings. Based on the information currently available from them, they have confirmed that copies of their database backups were made, and while it hasn’t been fully confirmed that data was taken away from their systems, the evidence so far suggests this is likely. At present, we have no evidence that your personal information has been misused. However, as a precaution we wanted to make you aware of the incident.
What data may be involved?
The information we hold about you in Beacon may include:
• your name
• postal address
• email address
• telephone number
• donation history
• Gift Aid declaration (where applicable)
Importantly the ICO have advised the data is not high risk (we do not keep referrals or similar sensitive information on this system) and for our supporters to keep an eye out for phishing emails. Please be assured that The Hugs Foundation does NOT hold any financial records such as card details or bank account information within Beacon.
What Beacon is doing.
Beacon has told us that they are:
• running a full forensic investigation with independent cyber-security specialists.
• reported the breach to the Information Commissioner’s Office (ICO) and are following their recommendations and those of their specialist cyber-security experts.
• working with law enforcement and relevant regulators.
• monitoring the dark web for any sign this data has been shared or sold – so far, nothing has been found
• resetting passwords and strengthening authentication on affected accounts.
What we, The Hugs Foundation, are doing.
We are:
• working closely with Beacon as they investigate further.
• updating security measures for any software we have linked to Beacon.
• reviewing our own security practices and access controls.
• documented the incident under our data breach procedures and are following regulatory obligations, we have notified the Information Commissioner’s Office (ICO) as well.
• assessed the potential risks to individuals, with support from the ICO, who have confirmed it is not high risk.
What you can do.
There is no action you need to take immediately. As a precaution, we recommend you to:
• be alert to any unusual and unexpected emails, calls or texts claiming to be from The Hugs Foundation or Beacon. We will never ask you to confirm your personal details or share credit card/debit card or bank account details.
• avoid clicking links or opening attachments unless you are confident they are genuine.
• never share passwords or one-time codes with anyone who contacts you unexpectedly.
• contact us directly using the details below if anything seems suspicious, rather than replying to a suspicious message.
We sincerely apologise for the concern this incident may cause and appreciate your understanding while the investigation continues. Protecting the personal information entrusted to us by our supporters is extremely important. As the investigation continues should we receive further information that affects you, we will contact you again as soon as possible.
If you have any questions, please contact Laura Dennis, Charity Manager via laura@hugsfoundation.org.uk
