Beacon CRM Cyber Security Data Incident - The Message

Beacon CRM Cyber Security Data Incident

Last updated: 5 August 2026, 4:00pm

Dear friend,

We are writing to let you know about a cyber security incident that has taken place involving Beacon CRM, The Message Trust’s external customer relationship management (CRM) provider. This incident is not specific to The Message Trust and it appears that all organisations that use Beacon CRM, all of whom are UK Christian and non-Christian charities, are affected.  

As some of the personal information we hold about you may have been affected we are getting in touch to tell you what we know, what this means for you and how you can protect yourself.

We are very sorry for this and any concern it may cause you. We take data security very seriously, this incident is outside of The Message Trust’s control and please be assured we are working hard to do all we can on this matter.

What happened 

On 3 August 2026, Beacon CRM informed us that it had experienced a cyber security incident involving unauthorised access to its systems during which copies of information were made and likely downloaded. As a result, personal information held by The Message Trust within Beacon CRM may have been accessed. Information such as contact details and event attendance.

Importantly, The Message Trust does not store any bank account details or payment card information within Beacon CRM, so we have no reason to believe that any banking, credit, debit or payment card information has been accessed through this incident.

What we are doing 

As soon as we heard about the incident, we took immediate steps to ensure our data security working closely with our Data Protection advisors, as well as reporting the incident to the Information Commissioner’s Office (ICO) and the Charity Commission.

We are keeping the situation under continual review as Beacon’s investigation progresses taking any action that is required immediately.

What you can do

You do not need to take any action but as we always want to be open and transparent we wanted to let you know what was happening.

As always please remain alert for any suspicious emails, text messages or phone calls claiming to be from The Message Trust or other trusted organisations. Please take care before clicking links or sharing personal information, and if you have any concerns please check any requests before doing anything by using the contact details on our website, not supplied in any suspicious message.

At present, we are not aware of any evidence that personal information has been misused as a result of this incident, these precautions are recommended to make sure youcontinue to protect yourself. Please also be aware The Message Trust will never ask you for unsolicited payments over the phone.

Our recent Urgent Appeal emails

Last week, we sent an Urgent Appeal email to many of our supporters. We’d like to reassure you that this email was genuinely from The Message Trust, and we are incredibly grateful to everyone who has responded so generously.

Further information

We are truly sorry for any concern this may cause. We will continue to keep you updated on this webpage as Beacon CRM’s investigation continues. You will also find some frequently asked questions below

If you have any questions or would like to discuss this any further with us, please contact:

You can find more information about the data The Message Trust holds in our privacy policy at message.org.uk/privacy

Thank you so much for your continued support of The Message Trust and your understanding on this, we are truly thankful for this. We know that this incident has affected many charities, including ourselves, so please do join us in praying for everyone impacted.

God bless
The Message Trust

Frequently asked questions

What has happened?

Beacon, the system we use to manage contacts, has told us that they have experienced a cybersecurity incident. Beacon has said that copies of database backups were made and were likely downloaded by an unauthorised third party. Their investigation is ongoing. 

Has my personal information definitely been accessed?

At this stage we don’t know if it has been accessed. We can’t confirm whether any individual’s information has definitely been accessed. 

What information may have been involved?

We cannot yet say exactly what information relating to any individual may have been affected. Depending on your relationship with us, the information held in Beacon may include some or all of the following: 

  • Name and contact details 
  • Records of your interactions with The Message Trust 
  • Donation or supporter information, but not financial information 
  • Event attendance or fundraising activity 

Was bank or card information affected?

No, we don’t store bank account details or payment card information within Beacon CRM, so we have no reason to believe that any banking or payment card details given to ourselves have been affected. 

Was this incident caused by The Message Trust?

No. Based on the information currently available, this incident affected Beacon CRM’s systems and is not specific to The Message Trust. Beacon has informed its customers that the incident is likely to have affected data held in Beacon accounts. 

What has The Message Trust done in response?

Since being notified of the incident, we have been working with Beacon, our Data Protection advisers and relevant partners to understand the potential impact and take appropriate action to ensure our future data security. 

Is there evidence that information has been misused?

At present, we are not aware of any evidence that personal information relating to The Message Trust has been misused as a result of this incident. However, because Beacon has said data may have been downloaded, we are advising people to be extra vigilant. 

What should I do?

Please be extra vigilant for suspicious emails, text messages, phone calls or letters claiming to be from ourselves, Beacon CRM or another trusted organisation especially if you are being asked for personal information or to click links. 

If you are unsure whether a communication is genuine, please contact us using contact details on our website rather than replying directly to the suspicious message. 

Will The Message Trust ask me for bank details or passwords?

No. We’ll never ask you to provide passwords, verification codes or sensitive financial information. If you receive a message asking for this information, please treat it as suspicious and contact us directly using the contact details on our website. 

Was the recent Urgent Appeal email genuine?

Yes. The recent Urgent Appeal email we sent out was genuine. We are grateful to everyone who has responded to that appeal.  

Can I still donate to The Message Trust safely?

Yes. If you wish to donate, please use the official donation routes on our website or another trusted method you already know. If you are unsure whether a link is genuine, visit our website directly rather than clicking a link in an unexpected message. 

A copy of our full privacy policy is available for you at message.org.uk/privacy