AWS key exposed in JavaScript may have lit way to Beacon's charity data

CRM provider confirms customer database was copied and probably downloaded in readable form

Beacon, a CRM provider for charities and nonprofits, says an AWS access key "potentially exposed in public JavaScript build artifacts" is the leading suspect in its July breach.

The revelation came in the company's first update on the attack in more than a week. If the access key was exposed in public build artifacts, it raises questions about why Beacon's development pipeline and code review controls failed to catch it.

Beacon used stronger wording about the potential data loss, confirming that a copy of the database was made and assessing that it was probably downloaded in readable form.

"This update confirms… that a copy of the database which holds all Beacon customer data, including attachment files, was made and likely downloaded in a readable format by the threat actor," wrote CTO David Simpson.

"Analysis of the AWS...

Copyright of this story solely belongs to theregister.com. To see the full text click HERE