Overview
Announced August 4 and updated August 5. The organisation cannot confirm whose information was acquired. Absence of evidence of misuse of bank/card information is not treated as proof those fields were not exposed. The Charity Commission’s August 7 guidance corroborates the provider incident, not an additive population across charities.
Timeline
- Occurred
- Discovered
- Disclosed
OM UK disclosed possible exposure.
Official notice updated.
Charity Commission published related guidance.
Organization response
OM UK notified the ICO and trustees, worked with Beacon’s external investigation and warned supporters about suspicious communications.
What you can do
Check notices through the organisation’s genuine contact channels. Do not enter credentials or payment details through links in unexpected messages.
Sources
- Important: cyber-security data incidentOM UK · 2026-11-09
- Guidance for charities affected by Beacon incidentCharity Commission · 2026-11-09