Charity CRM provider traces its July breach to an AWS key in a public JS build

Beacon, a CRM platform used by UK charities and nonprofits, says an AWS access key "potentially exposed in public JavaScript build artifacts" is the leading suspect in a breach that began in the early hours of July 27. CTO David Simpson said in the company's first update in over a week that a copy of Beacon's full customer database, including attachment files, was made and was probably downloaded in a readable format.

The mechanism is the part worth noting: a live AWS key shipped inside a client-side JavaScript bundle is a secret a small team's build pipeline can leak without anyone catching it, since a normal build step doesn't flag an embedded credential as a problem on its own. Beacon's data was encrypted at rest, but the exposed key reportedly gave the attacker a path to decrypt it.

Simpson said AWS Cost and Usage reports from May through July showed a spike in data transfer on July 27 and 28 that lines up with the attack window, and that the intrusion lasted one hour and 27 minutes with no persistence mechanism left behind in AWS. Beacon has more than 1,500 customers; it hasn't determined how many had data taken, and Simpson warned that some details of the incident may never be recoverable.

More than a dozen charities, including Molly Rose Foundation, Macmillan Cancer Support Jersey, and English National Ballet, have confirmed they're affected since Beacon disclosed the attack on August 4.

The preventable part is straightforward: keep long-lived AWS keys out of anything that reaches a browser, scope build-time credentials to short-lived tokens, and add a secret-scanning step to CI before a bundle ships.