UK mental health charity LawCare has warned anyone on its database to be on their guard following a cyberattack at one of its key suppliers.
LawCare is one of a number of charities to have been impacted by a data breach at Beacon CRM, which provides customer relationship management (CRM) software for more than 1,000 charities and non-profits.
LawCare first made people aware of the breach on 4 August via a statement on its website, which has been updated as further information emerges, while people on its database have also been emailed with information about the breach and advice on how to respond to any suspicious communications.
In the email sent earlier today, which has been seen by GLP, interim chief executive Trish McLellan and chair of the trustees Emma Williams said Beacon CRM had advised LawCare that it "may want to assume that all data that we store in Beacon, including attachment files, have been downloaded".
They add: "We understand that this news may be worrying and we are very sorry that information you have shared with us may have been affected."
LawCare uses Beacon CRM to manage information about its callers, supporters, donors, volunteers and fundraising contacts, although the charity has confirmed that the Beacon data did not contain "bank account numbers, sort codes, card numbers, or card security details".
The email warns: "Please be cautious about unexpected phone calls, messages, emails, links or requests for personal information, as contact details could potentially be used for phishing or other unsolicited communications. Be particularly alert to any communication that appears to be from LawCare."
Anyone unsure whether a communication is genuine is advised to email [email protected].
Further information about LawCare's response to the breach is outlined in the latest website update, which says "there is currently no evidence that any of this information has been published or misused and LawCare is not aware of any fraud or harm resulting from this incident".
It adds: "Although this wasn’t an issue caused by LawCare, we’ve taken the opportunity to review our Data Protection Impact Assessment (DPIA), Record of Processing Activities (ROPA) and business continuity plan, and we’re satisfied that the measures we have in place are robust."
It adds that LawCare informed The Information Commissioner’s Office about the incident, which has confirmed that the case is now closed.
A spokesperson said LawCare staff were "meeting daily to share updates and coordinate our response" and were poised to report the incident to The Charity Commission and The Office of the Scottish Charity Regulator.
In an update to customers on 4 August on what it has described as a cyber-security incident, Beacon stated: "Currently, our investigation has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party. We have evidence that shows a spike in activity during the incident timeline symptomatic of data leaving our systems.
"It is highly unlikely we will be able to ascertain any more granular detail regarding exactly what data this was and to whom it relates, so out of an abundance of caution, you may want to assume that all data that you store in Beacon, including attachment files, has been downloaded."
LawCare is one of the UK legal sector's best-known charities and provides confidential mental health and wellbeing support for people in the legal sector in the UK, the Channel Islands and the Isle of Man via a helpline, live webchat and email.
McLellan stepped up from her role of director of engagement to become interim CEO on 1 July following longstanding CEO Elizabeth Rimmer's retirement.
Mark Evans, the current president of the Law Society of England and Wales, is due to become CEO on 2 November.
LawCare is a former official charity of the Women and Diversity in Law Awards, which are hosted by The Global Legal Post, and was a supporting organisation this year.
Email your news and story ideas to: [email protected]
