AT least eight Island charities have confirmed that they may be affected by a potential cyber security incident.
The Information Commissioner confirmed to the JEP that a stream of charities had contacted his office after being told by software provider Beacon CRM about concern that there may have been unauthorised access to customer databases.
On Tuesday, Macmillan Jersey became the first local charity to reveal that it “could have been affected” as a result of Beacon CRM holding its data, several other charities have issued similar confirmation, including Jersey Trees for Life, Healing Waves and the JSPCA Animals’ Shelter.
Information Commissioner Paul Vane said that a total of eight organisations had contacted his office by 12.30pm yesterday. The issue has also affected UK-based charities including Breast Cancer UK, the Institute for Voluntary Action Research and the English National Ballet.
Mr Vane said: “I can confirm we are aware of the situation with Beacon CRM and are liaising with UK colleagues in terms of what action they will be taking.
“Beacon CRM is a UK-based provider and therefore would fall under the UK Information Commissioner’s regulatory remit.”
In emails to supporters, Jersey charities sought to reassure those concerned about a possible financial impact that bank account or payment card information was not included in the data managed by Beacon.
- The JSPCA said it was “genuinely sorry this has happened” and that is “takes the protection of your personal information extremely seriously”.
- Jersey Trees for Life’s said it was too soon to confirm whether its data had been compromised, but that “we are taking a precautionary approach and informing you of this potential personal data breach”.
- Max Wiltshire and Dominic Booth, co-founders of Healing Waves, said: Although the incident relates to one of our trusted suppliers, rather than our own systems, we know how important your personal information is. We also believe in being open and transparent with the people who support our work, so we wanted to let you know what has happened, what information we hold and what we are doing in response.”
Beacon CRM’s response stated: “We are currently investigating the full circumstances of the incident with external cyber-security specialists, but our current understanding is that compromised credentials were used to gain access to Beacon.”
The charities involved have urged anyone with concerns to make contact directly.
A spokesperson for the Charity Commissioner said the commissioner was aware of the incident and that any organisations with concerns could raise these directly with his office, or by getting in touch with the Information Commissioner’s office – jerseyoic.org
