Full Report
CRM provider confirms customer database was copied and probably downloaded in readable form
Analysis Summary
# Incident Report: Beacon CRM AWS Key Exposure & Data Breach
## Executive Summary
Beacon, a CRM provider for the non-profit sector, suffered a significant data breach in late July 2026 after an AWS access key was exposed in public JavaScript build artifacts. An attacker used this key to create a full copy of the customer database, including attachments, likely downloading it in a readable format. The incident impacted a wide range of high-profile charities, leading to the potential exposure of donor personal information and financial records.
## Incident Details
- **Discovery Date:** July 2026 (Detailed analysis completed August 2026)
- **Incident Date:** July 27–28, 2026
- **Affected Organization:** Beacon (Beacon CRM)
- **Sector:** Software as a Service (SaaS) / CRM for Charities and Non-profits
- **Geography:** United Kingdom / Global
## Timeline of Events
### Initial Access
- **Date/Time:** July 27, 2026, early morning hours.
- **Vector:** Credential Leakage.
- **Details:** An AWS access key was inadvertently included in public JavaScript build artifacts, allowing unauthorized access to Beacon's AWS infrastructure.
### Lateral Movement
- **Details:** Minimal lateral movement was required; the compromised AWS key provided direct access to data storage services. No persistence mechanisms were established within the environment.
### Data Exfiltration/Impact
- **Date/Time:** July 27–28, 2026 (Duration: 1 hour and 27 minutes).
- **Details:** Threat actors made a copy of the primary customer database. AWS Cost & Usage reports showed a significant spike in data transfer during this window, confirming substantial downloads of database records and attachment files.
### Detection & Response
- **How it was discovered:** Initial detection via suspicious activity; root cause identified through AWS Cost & Usage report analysis and forensic review of build artifacts.
- **Response actions taken:** Revocation of the compromised AWS key, forensic investigation by the CTO, and notification to the Charity Commission and impacted customers.
## Attack Methodology
- **Initial Access:** Valid Accounts (Compromised AWS Access Key leaked in public JS code).
- **Persistence:** None (Attacker completed the objective and exited).
- **Privilege Escalation:** Not applicable (The leaked key provided sufficient permissions for data access).
- **Defense Evasion:** Use of legitimate AWS credentials to bypass traditional perimeter security.
- **Credential Access:** Credential Leakage (Publicly accessible JavaScript build artifacts).
- **Discovery:** Cloud Service Discovery (Using the key to identify accessible storage/databases).
- **Lateral Movement:** Not observed.
- **Collection:** Data from Cloud Storage Object / Automated collection of database copies.
- **Exfiltration:** Exfiltration over Web Service (AWS data transfer).
- **Impact:** Data Encrypted at Rest was bypassed because the key allowed the attacker to retrieve data in a readable format.
## Impact Assessment
- **Financial:** Undisclosed, but likely significant due to forensic costs and potential regulatory fines.
- **Data Breach:** Full database copy including customer data and file attachments for over 1,500 customers.
- **Operational:** No reported downtime of the CRM, but significant resource diversion for incident response.
- **Reputational:** High; high-profile victims include Macmillan Cancer Support Jersey, English National Ballet, and the British Deaf Association.
## Indicators of Compromise
- **Network indicators:** Significant spike in data egress from AWS infrastructure on July 27–28, 2026.
- **File indicators:** Presence of AWS access keys in public-facing `main.js` or similar build bundles.
- **Behavioral indicators:** API calls to database backup or snapshot services originating from unexpected or non-corporate IP addresses.
## Response Actions
- **Containment:** Immediately invalidated the exposed AWS access keys.
- **Eradication:** Scrubbed public JavaScript artifacts to ensure no further credentials remained exposed.
- **Recovery:** Advised customers to perform individual risk assessments on the specific data types stored within their CRM instances.
## Lessons Learned
- **Secret Management:** Hardcoding or leaking credentials in client-side code remains a critical vulnerability.
- **Visibility Gaps:** Logs were unable to pinpoint specific records accessed, forcing the company to assume a "worst-case" total data loss scenario.
- **Monitoring:** Cloud cost and usage reports are effective secondary detection mechanisms for large-scale data exfiltration.
## Recommendations
- **Automated Secret Scanning:** Implement tools (e.g., TruffleHog, GitHub Secret Scanning) in the CI/CD pipeline to block deployments containing sensitive keys.
- **Least Privilege:** Ensure AWS keys used for specific services do not have broad permissions to copy or download entire databases.
- **Encryption Management:** Use AWS KMS with restrictive policies so that even if a key is stolen, it cannot be used to decrypt data outside of a specific VPC or environment.
- **Egress Filtering/Alerting:** Set up real-time alerts for unusual data transfer volumes from cloud storage buckets.