Back to help centre

</aside>

<aside>

What happened

Beacon is the supplier Bankuet uses to manage our donor and supporter records.

On Monday 3 August 2026, Beacon informed us that an unauthorised third party had gained access to their systems using compromised credentials, and that copies of their database backups had been made. Beacon became aware of the incident on 29 July 2026.

Beacon's investigation is ongoing, but the evidence so far indicates those copies were likely downloaded. Beacon has advised all its customers to assume that data held in their accounts has been affected.

This incident happened at Beacon, not at Bankuet. It affects organisations across the charity and tech-for-good sectors who use the same platform.

</aside>

<aside>

What information was involved

The information we held in Beacon may include:

Your name
Your email address
Your postal address
A record of donations you have made, including amounts, dates, and which food bank they supported
For fundraising organisers, your campaign details — campaign name, target and end date
For partner food banks, organisation names and addresses, and in some cases a named contact </aside>

<aside>

What was not affected

Your card and bank details. These have never been held in Beacon. Payments are handled by Stripe, PayPal and GoCardless.
Your Bankuet password. No passwords were held in Beacon.
The food bank ordering platform. foodbank.bankuet.co.uk is a separate system and was not part of this incident. Food bank balances, requests and deliveries are unaffected. </aside>

<aside>

What we have done

Replaced every key and connection between Bankuet and Beacon
Reset our team's access to Beacon, including passwords and two-factor authentication
Reviewed and re-authorised our payment provider connections
Reported the incident to the Information Commissioner's Office
Reviewed exactly what data we held in Beacon so we could tell people accurately

Beacon has contained the incident, remediated the cause, and is working with external cyber-security specialists, law enforcement and regulators.

</aside>

<aside>

What we would ask you to do

The main risk from this kind of incident is targeted phishing — someone using real details to send a convincing but fake message.

<aside> 🛡️

Bankuet will never ask you for your bank details, card details or a password by email, phone or text.

</aside>

If a message asks for any of these, it is not from us.
Treat unexpected emails, calls or letters about your giving with caution, even if they mention real details
Do not click links in messages you were not expecting — come to bankuet.co.uk directly instead
If something looks off, email us and we will confirm whether it came from us

As of the last update, there is no evidence that this data has been published or misused, and there has been no ransom demand.

</aside>

<aside>

Questions

Beacon has published its own information about the incident:

If you have any additional questions or concerns, please contact us via the form below

https://bankuet.typeform.com/to/eeDjspxe

</aside>