RNLI tells supporters their data may be exposed after CRM hack

According to Guardian News and Media, the Royal National Lifeboat Institution has written to its supporters to warn them that a cyber-attack on a third-party supplier may have exposed their personal information. The letter, sent with the autumn copy of the charity's Lifeboat magazine, tells members that their name, contact details and records of interactions with the RNLI could have been taken.

The breach happened at Beacon CRM, a customer relationship management company the RNLI uses to manage supporter data. Beacon told the RNLI, and around 1,500 other charities it works with, to assume that data held in its systems was taken during a cyber-attack in late July. The RNLI chose to tell its supporters directly and in writing rather than wait for confirmation of what exactly was accessed.

What was done

The RNLI notified its members before there was any evidence of misuse. Beacon CRM's own report on the incident, published earlier this month, found no sign the attack targeted Beacon or any single customer, and said the attacker made contact only to say the data would be deleted rather than retained, sold or shared. The RNLI has stated there is no evidence to date that supporters' personal data has been misused, shared or published.

That sequence matters because it shows the charity treating a supplier's breach as its own responsibility to disclose, rather than leaving supporters to find out secondhand. The warning reached members through the same channel the RNLI already uses to communicate with them, the Lifeboat magazine mailing, so nobody had to go looking for the news.

The disclosure lands at a difficult moment for the charity. RNLI crews have faced intimidation from people opposed to the charity's rescues of small boats crossing the Channel. A protest on 6 September saw activists try to block a road near Eastney in Portsmouth as two RNLI crews brought a dinghy carrying 120 asylum seekers ashore; police officers were injured. Crew members were called traitors in the aftermath, the Portsmouth museum at RNLI headquarters in Poole closed temporarily, and volunteers were advised they could stop wearing branded clothing if they felt at risk. Sir Robin Knox-Johnston, the RNLI's vice-president, called the abuse aimed at staff and volunteers "frankly quite disgraceful".

Far-right protesters called for donations to stop. The RNLI reported the opposite happened: a significant boost to fundraising followed. The charity has also pointed out that small boat rescues made up only 1.2% of its callouts last year, 109 out of 9,058.

For anyone who has given money or contact details to the RNLI, the letter is the first official word on whether their information was caught up in the breach. It means checking post and email from the charity for that notice, rather than assuming silence means safety, and watching for any contact that claims to be from the RNLI but asks for details the charity would already hold.