The UK legal mental health charity says Beacon database backups were likely downloaded and warns contacts to be wary of phishing attempts.
UK mental health charity LawCare, which caters to members of the legal profession, has confirmed that its database was compromised in a cyberattack on software company Beacon CRM, as reported by the Law Society Gazette. LawCare was one of over a thousand charities using Beacon to manage data on callers, supporters, donors, volunteers and fundraising contacts.
Beacon said its investigation found that hackers used a compromised access key to access the system. It said its data were encrypted but the hackers were likely to have decrypted them. In a statement published by the Gazette, LawCare said Beacon's investigation, supported by external cyber security specialists, confirmed that copies of database backups were made and likely downloaded by an unauthorised third party. LawCare said Beacon recommends assuming that all data stored in Beacon, including attachment files, has been downloaded.
LawCare said the system did not store lawyers' bank account numbers, sort codes, card numbers or card security details. It warned that the compromised information could be used in phishing attempts and told people who had been in touch with the charity to be wary of unexpected phone calls, messages, emails, links or requests for personal information. It said that to date the information had not been publicised or misused and that it was unaware of fraud or harm resulting from the incident. It urged people with questions or concerns to contact its data protection officer.
LawCare said it had advised the Information Commissioner's Office, which said the case had been closed. Beacon said it flagged and contained the incident quickly and had resumed normal operations. The Charity Commission said it was tracking the situation and encouraged the affected charities to file serious incident reports.
Over 753 people contacted LawCare last year, according to its Impact Report 2025. In May 2025, the UK Legal Aid Agency was hacked, compromising personal data dating back to 2007.
