In August, the Charity Commission (‘the Commission’) issued guidance for charities affected by the Beacon CRM cyber security incident. The incident is a real-life example of the risks highlighted by the Cyber Breaches Survey and shows why cyber resilience remains an important governance issue for charities.
A recent reminder: the Beacon cyber incident
In late July, Beacon, a customer relationship management platform used by more than a thousand charities and non-profit organisations, became aware of a cyber incident affecting its systems. Public reporting indicates that compromised credentials were used by an unauthorised third party to access Beacon’s systems and make copies of database backups.
The incident led to a number of charities reporting to the Commission, who subsequently issued guidance signposting affected organisations to relevant support.
The Commission highlighted the importance of taking prompt action following a cyber incident, including considering whether reports need to be made to other relevant regulators, such as the Information Commissioner’s Office (ICO), and communicating clearly with stakeholders where personal data or trust in the charity may be affected.
The Beacon incident also highlights a wider point for the sector: cyber risk is not limited to a charity’s own internal systems. Many charities rely on third-party platforms to hold donor, supporter, volunteer and beneficiary information. As a result, cyber governance should include appropriate due diligence over key suppliers, clarity over where data is held, and an incident response plan that covers supplier-related breaches.
What the latest survey tells us about charity cyber risk
The Beacon incident is not an isolated concern; it sits against a wider backdrop of continuing cyber exposure across the charity sector.
However, the latest government survey says that cyber security prioritisation is declining, especially among smaller charities, with only 30% of charities assign cyber responsibility at trustee level and fewer boards are receiving regular cyber updates.
Published in April 2026, Cyber security breaches survey 2025/2026 was commissioned by the Department for Science, Innovation and Technology (DSIT) and the Home Office.
The survey provides an overview of the cyber security landscape for UK businesses and charities. Results for the public sector and education are separately published.
The survey highlights a concerning trend that activity in relation to cyber risks has plateaued perhaps with some complacency. Smaller charities in particular appear to be reducing their attention to cyber risk despite continuing exposure to phishing, fraud, ransomware and data loss threats.
Key statistics include a fall in priorities from 68% to 60% (53% of charities with income below £100,000).The proportion of high income charities receiving cyber security updates at least annually has fallen from 78% to 69%. Whilst these figures still seem high the incidence of cyber attacks is not decreasing.
- 28% of charities experienced a cyber breach or attack in the last 12 months.
- 25% of charities experienced phishing attacks.
- 14% of charities experienced cyber crime.
- An estimated 57,000 UK charities experienced a cyber breach or attack.
Phishing remains by far the most common threat and the most disruptive form of attack reported
by charities.
The figures for schools and universities are higher still with 96% of FE and HE institutions encountering phishing attacks and also higher levels of impersonation attacks, malware, viruses
and spyware.
About 49% of those experiencing at breach reported a negative outcome. Consequences included:
- Compromised accounts being used for illicit purposes (23%)
- Websites or online services being slowed or unavailable (16%)
- Loss of access to files or networks (14%).
The survey identified engagement in the education sector as much higher than in the charity sector with 81% undertaking activities to identify cyber risks. Personal data was highlighted as a key sector vulnerability, alongside rapidly developing AI use.
44% of high income charities did have a formal cyber security strategy in place, an increase on the 39% of the previous year, but still down from 47% in 2024. 31% (2025: 34%) of charities had cyber security insurance cover as part of a wider insurance policy and 5% (2025: 5%) a specific insurance policy.
Why this matters for trustees
Trustees should treat cyber resilience as a core governance responsibility alongside safeguarding, finance and compliance.
Clear board oversight, regular reporting and basic cyber controls remain the most effective actions charities can take to reduce risk.
Next steps
Trustees should seek assurance that:
- Cyber security appears on the board risk register.
- A trustee or committee has oversight responsibility.
- The board receives at least annual cyber security reporting.
- A cyber incident response plan exists and has been tested.
- Staff and volunteers receive periodic cyber awareness training.
- Multi-factor authentication is enabled for key systems.
- Personal data is appropriately protected and encrypted.
- Key suppliers and outsourced providers are subject to cyber due diligence.
- The organisation has considered Cyber Essentials certification.
- Cyber risks associated with AI tools are understood and managed.
If you would like to discuss how PEM can support your charity, please get in touch.
