Last updated: 4 August 2026

DocBike has been informed of a cyber-security incident affecting Beacon CRM, the specialist charity database that many UK charities use to manage contact information for their supporters and volunteers.

In brief

  • The unauthorised access occurred within Beacon’s systems, not through a breach of DocBike’s own systems.
  • Information held in DocBike’s Beacon account may have been copied.
  • DocBike does not store bank, card or other payment details in Beacon.
  • The type of information we hold has been assessed as presenting a low risk in the event of a breach.
  • No specific action is required, although everyone should remain alert to unexpected or suspicious emails.

What happened?

Beacon has confirmed that an unauthorised third party gained access to its systems. Copies of database backups were made and were likely downloaded. Beacon has said that it may not be possible to identify exactly which records were included, so DocBike is taking the cautious approach that information held in our Beacon account may have been accessed.

Beacon is continuing its investigation with external cyber-security specialists and is working with law enforcement and relevant regulators.

Why does DocBike use Beacon?

Good data governance means storing information in a dedicated, access-controlled system rather than relying on informal contact lists. DocBike uses Beacon because it is a specialist customer relationship management platform designed for charities. This helps us control access, manage records consistently and retain only the information we reasonably need.

No organisation can remove every cyber-security risk, particularly where a specialist third-party service is involved. We therefore also limit the information we collect so that the potential impact on our supporters and volunteers is reduced if a provider experiences an incident.

What information might be involved?

The information held varies according to a person’s relationship with DocBike. Not every record contains all of the following.

Most commonly, we hold:

  • Name
  • Email address
  • Total value of donations made to DocBike
  • Courses or events attended

Less commonly, we may hold:

  • Postal address
  • Telephone number
  • Age, but not date of birth, for some NextGen course attendees
  • Type of motorcycle ridden, for some NextGen course attendees

What information is not held in Beacon?

DocBike does not store bank details, card details or other payment information in Beacon. Donations, shop purchases and ticket payments are processed by separate payment providers, and those financial details are not held on the Beacon platform.

We do not use Beacon to store sensitive personal records about our supporters or volunteers.

What is the risk?

DocBike reported the incident to the Information Commissioner’s Office. Because we deliberately collect limited information and do not hold financial or sensitive personal data in Beacon, the nature of the information involved was assessed as presenting a low risk.

The most realistic potential risk would be an email phishing or scam attempt using a person’s name or email address. There is currently no evidence that this is happening in connection with the incident. Beacon has also reported that its monitoring has found no information linked to the incident on the dark web.

Beacon normally stores information in an encrypted state. However, it has advised customers that the unauthorised third party may have been able to decrypt the copied data, so DocBike is taking the cautious approach that the information may have been readable.

Do I need to do anything?

No specific action is required at present. As a sensible precaution:

  • Be cautious about unexpected emails, particularly those asking you to click a link or provide personal information.
  • Check the sender’s email address carefully.
  • Do not send passwords, bank details or full card information by email.
  • If an email claiming to be from DocBike does not seem genuine, contact us using the address below before responding.

What has DocBike done?

As soon as Beacon informed us of the incident, DocBike followed its data-security procedures and:

  • Completed the precautionary security measures recommended by Beacon;
  • Reported the incident to the Information Commissioner’s Office;
  • Reported the incident to the Charity Commission;
  • Reviewed the type of information held and the possible risk to individuals; and
  • Continued to monitor Beacon’s investigation and updates.

We are informing our supporters and volunteers because we believe openness and transparency are important, even where the assessed risk is low.

Further information and updates

We will update this page if Beacon provides important new information that changes the position for DocBike supporters or volunteers.

Beacon also publishes technical incident updates for organisations using its service. These are available at Beacon’s incident FAQs.

You can read more about how DocBike handles personal information in our Privacy Statement.

Contact us

If you have a question or concern about information DocBike holds about you, please email dataprotection@docbike.org.

Share This