It was one of over a thousand charities impacted by a data breach at software company Beacon CRM
UK mental health charity LawCare, which caters to members of the legal profession, has confirmed that its database was compromised in a cyberattack on software company Beacon CRM, reported the Law Society Gazette.
LawCare was one of over a thousand charities using Beacon to manage data on callers, supporters, donors, volunteers, and fundraising contacts. The software company said in a statement that per investigations, hackers used a compromised access key to access the system. Beacon said that its data were encrypted, but the hackers were likely to have decrypted them.
“Beacon’s investigation into the incident, supported by external cyber security specialists, has confirmed that copies of database backups were made and likely downloaded by the unauthorised third-party. They recommend that we may want to assume that all data that we store in Beacon, including attachment files, have been downloaded”, LawCare said in a statement published by the Gazette.
While the system did not store lawyers’ bank account numbers, sort codes, card numbers, or card security details, LawCare warned that the compromised information could be used in phishing attempts. Thus, it warned those who had been in touch with the charity to be wary of unexpected phone calls, messages, emails, links, or requests for personal information.
The charity also confirmed that it had advised the Information Commissioner’s Office of the incident. Beacon said that it had flagged and contained the incident quickly and that it had resumed normal operations.
The ICO said the case had been closed.
“We understand that this news may be worrying, and we are very sorry that information people have shared with us may have been affected”, LawCare said in a statement published by the Gazette.
The charity said that to date, the compromised information had not publicised or misused; moreover, it was unaware of fraud or harm that occurred as a result. Nonetheless, LawCare urged people to contact its data protection officer for questions or concerns.
The Charity Commission said it was tracking the situation and encouraged the impacted charities to file serious incident reports.
Last year, over 753 people contacted LawCare per its “Impact Report 2025.” A hundred and forty lawyers obtained help for mental health and wellbeing matters through the charity’s online chat.
LawCare is not the first UK organization to be victimised in a cyberattack. In May 2025, the UK Legal Aid Agency was hacked, compromising personal data dating back to 2007.
