RNLI affected by Beacon CRM cyber security incident

On Monday 3 August, Beacon CRM informed us it was investigating unauthorised access to its systems.

Beacon CRM has now advised affected organisations, including the RNLI, to assume that data stored within its systems has been accessed and taken.

While it cannot confirm exactly which records were involved, analysis of the incident indicates that a significant volume of data was likely downloaded by the unauthorised third party.

No, the RNLI has not experienced a cybersecurity incident affecting its IT systems. Beacon CRM, is a third-party provider which holds some information relating to RNLI, that has informed us of a security incident it recently experienced. 

There is no indication the RNLI was specifically targeted. We are one of hundreds of charities and organisations that Beacon CRM works with who are potentially impacted.

The information relating to RNLI supporters held within Beacon CRM’s systems may include some or all the following:  

• Names  
• Postal addresses  
• Email addresses  
• Telephone numbers
• Date of birth
• Records of supporter interactions with the RNLI  
• Incomplete bank account details (which could not be viewed in their entirety)
• Personal information shared with the RNLI when contacting us about services and activities

The exact information varies between supporters because it is dependent on the relationship we have with you.

As soon as we were informed about the incident, we took immediate action. 

This includes:

• Working with Beacon CRM, independent cyber security specialists and relevant authorities to understand the potential impact.
• Reviewing the information affected and assessing risks to individuals.
• Reporting the incident to relevant Data Protection regulators.
• Suspending any further data transfers with Beacon CRM.
• Continuing to monitor the situation and support affected individuals.
• Publishing information about the incident on our website.

The RNLI has notified the relevant data protection regulators, as well as the Charity Commission and Gambling Commission.

We are continuing to work with relevant regulators and are providing updates as our investigation progresses.

Yes. Beacon CRM has confirmed that it is cooperating with a criminal investigation being led by the Metropolitan Police into the cyber security incident affecting its systems.

The investigation relates to the unauthorised access to Beacon CRM's systems and is not an investigation into the RNLI.

As this is an active investigation, there may be limits to the information that can be shared publicly while enquiries continue.

Protecting our supporters is our priority. Our investigation has shown that different groups of supporters may have been affected in different ways, so we are tailoring our approach accordingly.

Where we believe a supporter’s information may be at greater risk because of this incident, we are contacting them directly by letter and email to explain what has happened, what information relating to them may have been involved, and any steps they may wish to take to help protect themselves.

We will continue to keep our communications under review and provide further updates where appropriate.

Although we’re not currently aware of any misuse of your information, we recommend staying vigilant. You do not need to take any action at this time and we are liaising with Beacon to ensure that there is not a repeat incident.

Please be especially cautious of unexpected emails, telephone calls, text messages or letters claiming to be from the RNLI, your bank or another trusted organisation, and never share passwords, one-time security codes or financial information in response to unsolicited requests.

The RNLI will never contact you and ask for your online banking password, PIN, or security codes. Your bank should never ask you to disclose passwords, PINs, one-time passcodes or other security credentials.

We also recommend the following:

• Take care before clicking links or opening attachments in unexpected communications.
• Regularly monitor financial accounts and statements for unusual activity.
• Report suspected fraud or scam activity to the appropriate authorities.
• Do not transfer money, make payments, or move funds between accounts in response to an unexpected request received by telephone, email or text messages.
• If you receive a call claiming to be from your bank, end the call and contact your bank using a telephone number obtained from its official website, or from the back of your bank card.
• If you are unsure whether a communication is genuine, independently verify the sender before taking any action.