The Harpur Trust has issued a clear reassurance to parents, guardians, and pupils following a cybersecurity incident involving an external database system used in its charity operations.
The Trust confirmed that no pupil, parent, or guardian records have been compromised, as the incident was strictly confined to a third-party platform and did not affect the Trust’s own IT infrastructure.
Third-Party platform affected
The incident centres on Beacon, a widely used customer relationship management (CRM) platform operated by an external supplier and utilised by more than 1,500 charities across the UK, including the Harpur Trust.
The Harpur Trust uses Beacon exclusively for its Communities Department and the local initiative Bedford Giving.
Bedford Giving is an independent charitable collaboration hosted by the Harpur Trust.
Beacon is completely separate from the IT systems and databases that hold school, student, or family records.
Beacon does not hold personal or financial records relating to Harpur Trust pupils, parents, or guardians, and the incident occurred entirely on Beacon’s systems, rather than a cyber-attack on The Harpur Trust’s internal network.
There is currently no evidence that any data relating to The Harpur Trust or Bedford Giving has been misused or published on the dark web, and no ransom demand has been made.
Swift response and precautionary measures
Upon being notified of the issue by the supplier, Trust staff acted immediately to assess the impact, implement additional security precautions, and notify the Information Commissioner’s Office (ICO).
The Trust has already contacted all individuals whose details were held on the Beacon platform directly to inform them of the situation.
Clare Lake, chief financial officer at The Harpur Trust, said: “We take our responsibility to protect personal data very seriously and are very sorry that this incident has occurred.
“As soon as we were notified by Beacon, we took immediate steps to understand the potential impact, implement additional precautionary measures and contact everyone affected, as well as report the matter to the Information Commissioner’s Office.”
She said that while Beacon had advised customers to assume their data had been accessed, there is currently no evidence of misuse of data relating to the charities.
A Beacon spokesperson said that the company understood it was concerning and reiterated that they were taking the situation “very seriously”.
“We recently experienced a cybersecurity incident that involved unauthorised access to Beacon systems containing data we process on behalf of our customers,” said the spokesperson.
“We immediately engaged external cybersecurity experts to help us contain the incident and investigate.
“We’ve already spoken with all our customers and our focus now is on supporting them as much as possible in any onward communication of their own regarding potential data impact.
“Beyond our immediate containment actions, Beacon hasn’t experienced any service interruption as a result of this incident, and our customers continue to access our platform and services as normal.”
Advice for the community
While school families are unaffected, The Harpur Trust advised anyone associated with its community outreach programs to remain cautious as a general best practice.
“We would also encourage people to remain vigilant for phishing emails, texts or phone calls and to avoid sharing personal or financial information in response to unexpected requests,” said Clare Lake.
The Harpur Trust continues to work closely with Beacon as the software provider’s investigation progresses and has committed to providing further updates to affected individuals if necessary.
