RNLI warns supporters their data may have been taken in hack of charity CRM provider

In a letter sent with the autumn edition of its Lifeboat magazine, the charity told members that their "name, contact details and records of interactions with the RNLI" could have been compromised in the raid on the supplier.

The Telegraph, which first reported the letter, said the RNLI had told supporters that Beacon CRM advised it to "assume that data held within its systems was taken" in a cyber-attack that affected about 1,500 charities in late July. The letter added that there was no evidence to date that members' personal data had been misused, shared or published.

The disclosure comes amid a period of pressure on the charity. On Thursday it emerged that a lifeboat station in Portsmouth, close to where far-right activists had tried to stop asylum seekers landing, had been forced to shut temporarily. On Sunday 6 September, activists tried to blockade the road leading to a landing spot where two RNLI crews helped bring a dinghy carrying 120 asylum seekers to Eastney in Portsmouth, a few hundred metres from the lifeboat station. Police officers were injured.

In the days that followed, lifeboat crew members were called traitors and protests were held against the charity, including at the RNLI headquarters in nearby Poole, where a museum telling the story of the RNLI closed temporarily. Portsmouth lifeboat station took down its Facebook page, and RNLI volunteers across the UK were told they should consider not wearing the charity's branded clothing if they felt it could put them at risk.

The RNLI vice-president, Sir Robin Knox-Johnston, condemned the intimidation aimed at staff and volunteers, including "online and physical abuse", as "frankly quite disgraceful". Far-right protesters had called for people to stop donating to the charity, but the RNLI reported that it had subsequently experienced a "significant" boost to its fundraising. It has stressed that only 1.2% of its rescue work last year, 109 callouts out of 9,058, was to small boats in the Channel.

A report on the hack published by Beacon CRM earlier this month said there was no evidence that it was a targeted attack on Beacon or any specific customer, and that the cyber-attacker had contacted it "only to indicate they would be deleting any data they have exfiltrated and no copy would be retained, sold, or shared".

A spokesperson for the RNLI said: "Beacon CRM works with many charities and organisations across the UK and Ireland, and while they cannot confirm exactly which records were accessed or downloaded, it advised all affected organisations, including the RNLI, to assume that data held within its systems was taken. At this stage, there is no evidence that information relating to RNLI supporters has been published, shared online or otherwise misused."

Editor's Summary

The RNLI has told members that their names, contact details and records of interactions may have been taken in a July cyber-attack on Beacon CRM, a supplier used by roughly 1,500 charities, though no misuse of the data has been identified. The warning coincides with protests and abuse directed at the charity by far-right activists over its rescues of small boats in the Channel, which the RNLI says accounted for 109 of its 9,058 callouts last year. Beacon CRM says it found no evidence the attack targeted it or a specific customer.