cyber.hendryadrian.com
Cyber Attack & Data Breach · securityweek.com

Beacon Says Data Breach May Affect More Than 1,000 Charity Customers

· Original article ↗

Summary

Beacon says attackers used a compromised AWS access key to download customer database backups, potentially exporting all database data. The breach may affect more than 1,000 charity customers; some supporter information may have been exposed.

Key points

  • Beacon observed malicious activity beginning July 27 and believes the data was transferred on July 27–28.
  • The company says attackers used a compromised AWS access key that may have been exposed in publicly available JavaScript build artifacts.
  • Available logs could not establish exactly which objects were accessed or the download destination; Beacon assessed that the actor exported all database data.
  • The downloaded backups were encrypted, but Beacon said attackers may have decrypted them before exfiltration.
  • Some charities said supporters’ names, phone numbers, email addresses, and postal addresses may have been compromised.
  • Some affected charities said bank and card details were not exposed because they were not stored in the system.
  • The UK Charity Commission is monitoring the situation; Beacon said it was not aware of the stolen data being published.

Article Details

Victim Organization
Beacon
Incident Type
Data breach involving the download and likely exfiltration of customer database backups from an AWS environment using a compromised AWS access key.
Data Types Exposed
  • Names
  • Phone numbers
  • Email addresses
  • Postal addresses
Affected Records
More than 1,000 Beacon customers were reportedly affected; the number of individual records was not disclosed.
Operational Impact
Customer database backups were downloaded. Beacon assessed that the threat actor exported all data in the database, but available logs could not establish exactly which objects were accessed or the download destination.
Ransom Or Extortion
No ransom or extortion activity was reported. No known cybercrime group claimed responsibility, and Beacon said it was not aware of the stolen data being published.
Claim Status
confirmed

MITRE ATT&CK

T1078.004 · Cloud AccountsBeacon reported that the threat actor used a compromised AWS access key to obtain data from its AWS environment.

Vendors

Amazon Web ServicesBeacon’s investigation found that the threat actor obtained the data from an AWS environment by using a compromised AWS access key that may have been exposed in publicly available JavaScript build artifacts.

Related Articles