The facts
The Royal National Lifeboat Institution (RNLI) has informed its supporters that their personal information may have been compromised due to a cyber-attack on Beacon CRM, a company the charity uses for customer relationship management. In a letter accompanying its autumn magazine, the RNLI stated that potentially exposed data includes names, contact details, and records of interactions with the charity. Beacon CRM advised affected organizations, including the RNLI, to assume that data held within its systems was accessed during the attack, which impacted approximately 1,500 charities in late July. The RNLI has stressed that there is currently no evidence to suggest that supporters' information has been published, shared online, or otherwise misused. This data breach notification occurs concurrently with a campaign of online and physical abuse targeting the RNLI, stemming from objections to its rescue operations involving individuals crossing the English Channel in small boats. The Guardian reported that a Portsmouth lifeboat station was temporarily shut down following a protest, and volunteers were advised to consider not wearing branded clothing if they felt unsafe. The RNLI has stated that rescues of small boats in the English Channel accounted for only 1.2% of its total rescue work in the past year. Beacon CRM's report on the incident indicated no evidence of a targeted attack on the company or any specific customer, with the attacker reportedly stating they would delete exfiltrated data without retention, sale, or sharing.
Our take
So the RNLI - the heroes who drag your soggy ass out of the drink when you're too stupid to respect the sea - has to send out a letter saying, 'Sorry, your name, address, and how often you've cried at our fundraising ads might be in the hands of some script-kiddie fuckwit.' The source? Not some shadowy state actor, but Beacon CRM, a company that apparently handles data for 1,500 charities with the digital security of a wet paper bag. They got hit in late July and their brilliant advice was for everyone to just 'assume' the data was accessed. What a comforting, professional standard. Assume my fist is in your ass, Beacon.
This shitshow lands while the RNLI is already getting harassed online and in person by the kind of bastards who think letting people drown is a valid border policy. Volunteers are being told to maybe not wear their lifeboat gear in public for safety. Let that sink in: people who run into freezing, violent water to save lives are having to consider going incognito because saving lives is now 'political.' The universe has a sick sense of humor.
The cherry on this shit-cake is Beacon's report, where the attacker, in a move of bizarre digital chivalry, apparently promised to delete the data without selling it. Oh, well, that's fine then! We'll just take the word of the criminal who just successfully hacked a vital charity service. What's next, a pinky swear? The RNLI has to stress that these migrant rescues - the thing causing all the frothy-mouthed rage - are a tiny fraction of their work. They're like a fucking hospital having to say, 'Don't worry, we only treat car crash victims 1.2% of the time, please stop throwing bricks at our ambulances.'
So now, the people who give a shit enough to donate to a lifeboat service get their personal details potentially floating around the dark web, thanks to a third-party vendor's fuck-up, all while the charity itself is under siege for doing its fucking job. It's a perfect, infuriating storm of modern incompetence and malice, where the good guys get hacked and harassed, and the only ones who come out clean are the ones who started the fire.
