Our statement and information for supporters
Updated Thursday 6 August 11:45
On Monday 3 August afternoon, ERCS was notified about a data breach affecting Beacon, our third-party CRM (Customer Relationship Management) provider.
ERCS uses Beacon to manage information relating to our donors, members, supporters and events. There is no information on Beacon relating to the legal services provided to clients of our Law Service.
Beacon have confirmed that an unauthorised third party gained access to their systems and that they immediately engaged external cyber-security experts to help secure their systems and investigate this further. Their investigation has confirmed that copies of its database back-ups were made and likely downloaded.
What information may be involved?
The information potentially affected is:
- Name
- Email address
- Postal address
- Telephone number
- Records of your interactions with ERCS
- Donation records.
Beacon has advised that it is unlikely to be able to establish which information was downloaded or who it relates to. We are therefore taking a precautionary approach and treating all data held in Beacon as potentially affected.
The information ERCS holds on Beacon does not include payment card details or bank account information, or special category personal data such as information relating to sexual orientation or racial or ethnic origin.
What are Beacon and ERCS doing?
Beacon has advised that they are operating normally, and they have regular cyber-security incident updates on their website.
Since being notified, we have also taken the following recommended steps to ensure security of supporter data:
- Changed all logins and updated passwords
- Reviewed the information held on Beacon
- Notified the Information Commissioner’s Office.
What can you do?
At this stage there is no specific action you need to take. However, we recommend that you remain alert to unexpected emails, text messages and telephone calls that ask you to provide personal information, make a payment or click on a link. If you receive any suspicious communication, please do not respond.
We are incredibly grateful for your trust and ongoing support and are very sorry for the inconvenience and concern this incident might cause. We take our data security responsibilities seriously and chose Beacon CRM because it is a top-rated, UK based company, especially built for charities with over 1,000 customers.
We will share further updates on our website but should you have any questions or concerns, you can contact our Finance & Operations Manager Jack Withy on 0131 358 0038 or email data@ercs.scot .
