On 3 August, Beacon CRM informed us they experienced a cyber-security incident that involved unauthorised access to its systems.

Beacon has advised us that information stored within its systems may have been downloaded by an unauthorised third party. Because Beacon does not expect to be able to identify precisely which records were affected, we are taking a precautionary approach and contacting people whose information may have been involved.

At present, there is no evidence that information relating to The Migraine Trust has been published, shared publicly or misused, but we wanted to make you aware of the situation and explain the steps we are taking in response.

The data we hold about you could include:

• Name
• Postal address
• Email address
• Telephone number
• Records of your interactions with us
• Donation, membership, volunteering or supporter information
• Information you have provided to us in connection with our services and activities
• Your contact details, donations history, and any information you have shared with us in connection with our services.

We can confirm that the data does not include useable card or payment details or other financial information. No bank account details, sort codes, card numbers or card security details were stored in our Beacon database.

Beacon CRM is a cloud-based customer relationship management platform used by over 1,000 charities including The Migraine Trust. We use this platform to store information about our service users, supporters, fundraisers, case studies of people living with migraine, and subscribers to our monthly newsletter.

Beacon has advised customers to assume that data stored within their Beacon account, including attachment files, may have been downloaded by an unauthorised third party. We therefore cannot rule out that information relating to you may have been affected.

At present, we are not aware of any evidence that information relating to The Migraine Trust has been published or misused.

We use Beacon to store information about people using our services, including those who contact our Support Line. We record brief summaries about people’s experience with migraine and the advice and information we have provided, using internal acronyms where appropriate.

Beacon has advised customers to assume that data stored within their Beacon account, including attachment files, may have been downloaded by an unauthorised third party. This means we cannot rule out that information shared with our support services may have been affected.

At present, we are not aware of any evidence that information relating to The Migraine Trust has been published, shared publicly or misused.

We are continuing to work with Beacon to understand the full impact of this incident and will share any significant updates as they become available. However, Beacon has advised that it is unlikely to be able to identify exactly which records were downloaded and has recommended that customers assume all data stored within Beacon, including attachment files, may have been downloaded. As a precaution, we are therefore informing people whose information may have been affected.

At present, we are not aware of any evidence that information relating to The Migraine Trust has been published or misused.

Beacon is progressing its investigation as quickly as it can with the help of cyber-security specialists. Cyber-security investigations are complex and can take time. Beacon will update us as soon as it has relevant information to share and we will update you in turn. Please keep an eye on this webpage for updates.

Beacon has engaged specialist cyber security experts and continues to investigate the incident. Beacon has advised customers that copies of database backups were likely downloaded by an unauthorised third party and is working with relevant regulators and law enforcement authorities.

The Migraine Trust has reported the incident to the Information Commissioner’s Office (ICO) and is continuing to assess whether any further regulatory notifications are required.

As soon as we were notified of the incident, we activated our data breach response procedures and took immediate steps to reduce any potential risk. This included disabling or revoking third-party integrations and API connections, resetting relevant credentials and obtaining independent security advice from our IT provider. We continue to work closely with Beacon to understand the full impact of the incident and will take any further action recommended as a result of the ongoing investigation.

You do not need to take any action, but you might receive emails, calls or texts claiming to be from The Migraine Trust when they are not, so do be vigilant. We recommend that you:

• Remain vigilant for suspicious emails, telephone calls, text messages or correspondence claiming to be from our organisation or any trusted third party.
• Exercise caution before clicking on links or opening attachments from unexpected communications.
• Never disclose passwords, verification codes or financial information in response to unsolicited requests.

Remember that we will never contact you to request financial information, like credit card details.

If you would like to get in touch with us to discuss any concerns you have, please email supportercare@migrainetrust.org or telephone 020 3951 0150.