AWS key exposed in JavaScript may have lit way to Beacon's charity data

Beacon, a CRM provider for charities, reported that an AWS access key potentially exposed in public JavaScript build artifacts likely enabled an attacker to copy and probably download its entire customer database and attachments. The malicious activity occurred on 27–28 July 2026, lasted about 1 hour 27 minutes, and has affected numerous charities; Beacon confirmed a database copy was made but cannot determine which specific records left its systems.