RNLI affected by Beacon CRM cyber security incident

On Monday 3 August, Beacon CRM informed us it was investigating unauthorised access to its systems.

Beacon CRM has now advised affected organisations, including the RNLI, to assume that data stored within its systems has been accessed and taken.

While it cannot confirm exactly which records were involved, analysis of the incident indicates that a significant volume of data was likely downloaded by the unauthorised third party.

Importantly, there is currently no evidence that information relating to RNLI supporters has been published, shared online or otherwise misused.

No, the RNLI has not experienced a cybersecurity incident affecting its IT systems. Beacon CRM, a third-party provider which holds some information relating to RNLI, recently informed us of a security incident it recently experienced. 

There is no indication the RNLI was specifically targeted. We are one of hundreds of charities and organisations that Beacon CRM works with who are potentially impacted.

The information relating to RNLI supporters held within Beacon CRM’s systems may include some or all the following:  

• Names  
• Postal addresses  
• Email addresses  
• Telephone numbers
• Date of birth
• Records of supporter interactions with the RNLI  
• Incomplete bank account details (which could not be viewed in their entirety)
• Personal information shared with the RNLI when contacting us about services and activities - this may include more sensitive personal data such as health information.  

The exact information varies between supporters because it is dependent on the relationship we have with you.

As soon as we were informed about the incident, we took immediate action. 

This includes:

• Working with Beacon CRM, independent cyber security specialists and relevant authorities to understand the potential impact.
• Reviewing the information affected and assessing risks to individuals.
• Reporting the incident to relevant Data Protection regulators.
• Suspending any further data transfers with Beacon CRM.
• Continuing to monitor the situation and support affected individuals.
• Publishing information about the incident on our website.

The RNLI has notified the Information Commissioner's Office (ICO), the Irish Data Protection Commission (DPC), the Office of the Data Protection Authority (ODPA) in Guernsey, the Jersey Office of the Information Commissioner (JOIC), and the Isle of Man Government, as well as the Charity Commission and Gambling Commission.

We are continuing to work with relevant regulators and are providing updates as our investigation progresses.

Yes. Beacon CRM has confirmed that it is cooperating with a criminal investigation being led by the Metropolitan Police into the cyber security incident affecting its systems.

The investigation relates to the unauthorised access to Beacon CRM's systems and is not an investigation into the RNLI.

As this is an active investigation, there may be limits to the information that can be shared publicly while enquiries continue.

Protecting our supporters is our priority. Our investigation has shown that different groups of supporters may have been affected in different ways, so we are tailoring our approach accordingly.

Where we believe a supporter’s information may be at greater risk because of this incident, we are contacting them directly by letter and email to explain what has happened, what information may be involved, and any steps they may wish to take to help protect themselves.

We remain committed to being open and transparent with all our supporters and will continue to provide updates through our website and RNLI publications.

For supporters whose information is not believed to be significantly affected, we do not think it would be appropriate to contact them individually and risk causing unnecessary concern or alarm.

We will continue to keep our communications under review and provide further updates where appropriate.

Although we’re not currently aware of any misuse of your information, we recommend staying vigilant.

Please be especially cautious of unexpected emails, telephone calls, text messages or letters claiming to be from the RNLI, your bank or another trusted organisation, and never share passwords, one-time security codes or financial information in response to unsolicited requests.

The RNLI will never contact you and ask for your online banking password, PIN, or security codes.

We also recommend the following:

• Take care before clicking links or opening attachments in unexpected communications.
• Regularly monitor financial accounts and statements for unusual activity.
• Report suspected fraud or scam activity to the appropriate authorities.