Youth Concern has been informed of a cyber security incident affecting Beacon, a third party customer relationship management (CRM) system, used by charities across the UK.

On 3 August 2026, Beacon notified its customers that it had experienced unauthorised access to its systems. According to Beacon, copies of database backups may have been accessed and downloaded by an unauthorised third party. Beacon’s investigation remains ongoing, and they are working with external cyber security specialists, law enforcement agencies and relevant regulators to establish the full extent of the incident.

What does this mean for Youth Concern?

It is important to note that Beacon is Youth Concern’s fundraising and supporter CRM. It is not the separate case management system used by Youth Concern to store records relating to the young people we support.

Information relating to young people who access Youth Concern’s services was not stored in Beacon and is not affected by this incident.

Youth Concern is still in the process of implementing Beacon and the system is not yet fully operational. At the time of the incident, Beacon contained only around 400 limited records, primarily relating to supporters, donors and other contacts.

Based on the information currently available, there is no evidence that information connected to Youth Concern has been misused, published or shared publicly. However, we believe it is important to be transparent and inform those who may be affected.

We can also confirm that payment card and bank account information is not stored within Beacon and is therefore not affected by this incident.

What information may have been involved?

The information held within Beacon may have included:

· Name

· Contact details

· Date of birth (where provided)

· Postal address

· Limited information provided in connection with Youth Concern, such as supporter, donor or event participation details

What are we doing?

Since becoming aware of the incident, Youth Concern has:

· Sought further information and clarification from Beacon regarding the breach and its potential impact.

· Reviewed the information held within Beacon and assessed the potential implications for affected individuals.

· Taken advice from the Information Commissioner’s Office (ICO) regarding our response to the incident.

· Continued to monitor updates from Beacon as their investigation progresses. Any significant updates will be posted on this page.

We have been informed that the breach has been contained, although Beacon’s investigation remains ongoing.

What should you do?

At present, there is no evidence that affected individuals need to take any specific action.

However, as a sensible precaution, we recommend remaining alert to:

· Unexpected emails, text messages or phone calls claiming to be from trusted organisations.

· Requests for personal information or account credentials.

· Suspicious links or attachments received by email or text message.

You should never share passwords, verification codes or financial information in response to unsolicited contact.

Further Information

We recognise that news of a data security incident can be concerning and we sincerely apologise for any worry this may cause.

Protecting the privacy and security of the young people and supporters who engage with Youth Concern is extremely important to us. While this incident occurred within a third party system and involved only a limited amount of data held during the early stages of our Beacon implementation, we are taking the matter seriously and will continue to work with Beacon and relevant authorities as further information becomes available.

If you have any questions regarding this incident, please contact Youth Concern directly.