Charity update: external data breach
We want to make our community aware of a significant data breach that recently affected Beacon, a CRM provider the charity previously worked with. Beacon provided a service we used to host message forms on our website, allowing individuals to contact the charity directly.
We chose to stop using Beacon earlier this year, before this data breach occurred. At this stage, we deleted all of our data, including all messages from individuals. However, we have now been made aware that a record of this deleted data had been kept by Beacon, which may have been accessible to the cybercriminals during the data breach.
As Beacon is currently unable to confirm which data has been accessed and downloaded, and because our message forms are sometimes used to share sensitive, personal information, we wanted to make sure our community was aware of the incident.
Could I be affected?
If you sent PANS PANDAS UK a message using our ‘contact us’ form, prior to 1st August 2026, your message will have been included in the database that may have been accessed.
The data did not contain passwords, financial details or identifiable technical information such as computer IPs. However, names, email addresses and phone numbers will have been collected, if provided, in addition to any message. We therefore encourage everyone to be vigilant and look out for phishing emails or spam phone calls
Is my child at risk?
Many of you shared sensitive information about vulnerable young people, and we are devastated that this could have been accessed by criminals.
We are aware that the breach has affected hundreds of organisations and charities, with criminals stealing a vast amount of data. The ICO believe this implies the criminals are not targeting specific causes or communities; rather they are after contact details which they can use for further criminal activity, such as phishing or spam communication. We ask our community to be cautious of unexpected phone calls, emails, links or requests of personal information or contact details.
What should I do if I am concerned?
Anyone with concerns is encouraged to contact PANS PANDAS UK directly via info@panspandasuk.org. We understand this incident may feel upsetting, and we are committed to supporting our community and answering questions openly and transparently.
What action has PANS PANDAS UK taken?
We have reported the data breach to the Information Commissioners Office (ICO) and have worked closely with them to complete a risk assessment.
Together, we have assessed the risk to our community as high. This status is because most messages sent to us contained contact details, including email and phone numbers, and many contained sensitive and highly personal information about vulnerable children and young people. Although there is no confirmation that this data was accessed, Beacon is also currently unable to confirm exactly which data was accessed or downloaded.
We have also informed:
- The Charity Commission for England and Wales
- The Office of the Scottish Charity Regulator
We are extremely concerned that data deleted in good faith remained potentially accessible, and we will continue to investigate this with Beacon and the ICO.
More information:
Was PANS PANDAS UK’s database or website hacked?
No. There is no evidence that PANS PANDAS UK’s internal systems, databases, passwords, payment systems, or member accounts were compromised. The incident relates specifically to a criminal data breach of Beacon CRM.
Was my financial information exposed?
No. No financial information or passwords were stored on this database.
Could this happen again?
Unfortunately, no online service or tool can ever be entirely risk-free, especially as AI continues to evolve. However, we have disabled our contact forms and encourage direct email communication.
