Data security update

We recently identified a data security issue involving Beacon, the CRM system we use to hold contact records. We’re sorry this has happened. If you’ve interacted with ACO before, whether as a member, event attendee, or newsletter subscriber, your details may be held on this system. 

What happened? 

Beacon, our CRM provider, has told us that a compromised access key was used to gain unauthorised access to their systems, which they’ve described as more sophisticated than a simple compromised password. Copies of Beacon’s database backups were made. Beacon has not confirmed that this data was taken, but their evidence suggests it’s likely. There is currently no evidence the data has appeared anywhere online, and no ransom demand has been made. 

When did this happen, and when did you find out? 

Beacon has said the incident occurred in late July 2026. We were notified by Beacon on 3 August 2026 and acted immediately to review our own data and secure our systems. 

What information was involved? 

The data affected includes names, organisation addresses, email addresses, and in some cases phone numbers held in our Beacon records. No payment or financial information was involved, and no sensitive personal data such as health information. There’s no evidence that any card details have been compromised and we do not keep them on this system. 

Is this just an ACO issue? 

No. This is a security incident at Beacon, a CRM platform used by over a thousand charities across the UK, not something that originated with ACO’s own systems. A number of other charities have also been affected and have been notifying their own contacts. 

What are you doing about it? 

We’ve taken immediate steps to secure our systems, including revoking and reissuing all access credentials, and we’re contacting everyone whose data may have been affected directly. 

What should I do? 

Given the nature of the information involved, the main risk is phishing attempts using this data. Please be cautious of any unexpected emails or calls referencing ACO and avoid clicking links or sharing further information without verifying the sender first. 

Will I be told if there’s more to know? 

Yes. We’re committed to keeping people informed as our understanding develops and will update this page if anything changes. 

Who can I contact? 

If you have any questions, or would like support as an ACO member, please contact us at info@aco.uk.net.