CY
CY
Hub Cymru Africa takes its responsibility to protect sensitive personal and business information very seriously.
On 3 August 2026, we were informed that Beacon CRM, which processes information of people we engage with on our behalf, had experienced a cyber-security incident. Beacon CRM’s current understanding is that compromised user login details were used to gain unauthorised access to its systems.
Beacon CRM has established that copies of its database backups were made. Although it has not yet confirmed that data was taken, the evidence currently available suggests that these copies were likely downloaded. This means that your personal or business information (name and email address) held on our Beacon account before 5am on 27 July 2026 may have been accessed. We do not collect or hold anyone’s financial information in this system.
Because of your relationship with Hub Cymru Africa, as a former event attendee, subscriber to our email updates, recipient of development support or engaged in another way, this information may have included your name, organisational address, your correspondence with Hub Cymru Africa, any communication preferences, or broader relationship with us. We are awaiting further updates from Beacon as to the specific substance of the data that has been breached.
Beacon has said there is currently no evidence that the information has been published online or that a ransom demand has been made. Its investigation is continuing with external cyber-security specialists. You can read more about what Beacon has said about the incident here.
As personal data has been breached, we have an obligation under the Data Protection Act (2018) to report this both to the Information Commissioner’s Office and to those affected. We therefore wanted to make you aware of this.
The clearest current risk is that someone could use this information to make a fraudulent email or message appear more convincing. Please be particularly cautious about unexpected communications referring to Hub Cymru Africa or your relationship with us. Do not click unexpected links, or provide passwords, security codes, banking information or other personal details. Hub Cymru Africa will never ask you for your banking or financial information.
Our priority has been to notify data subjects affected by the breach so that you and they can take appropriate remedial steps. We have also begun taking further precautionary action, including securing Hub Cymru Africa’s access to our Beacon account, resetting passwords and disconnecting applications and integrations with Beacon. In doing so, we are following guidance from the Information Commissioner’s Office and the Charity Commission and meeting our regulatory reporting requirements. You can read our full Privacy Policy on our website here.
We apologise unreservedly for the concern this incident may cause. We will provide further information as soon as Beacon’s, or our own, investigation identifies any material changes to the position outlined above. We understand that this may affect your trust in us, and if you wish to change your contact preferences, or have any specific requests, questions or concerns, please do get in touch with us by emailing enquiries@hubcymruafrica.wales.
Beacon will keep their public statement updated here as they receive new information.
If you receive a communication that appears suspicious, please contact us independently on enquiries@hubcymruafrica.wales. Please do not use contact details or links contained within the suspicious message itself.
