Arnos Vale Cemetery Trust has been informed of a cyber-security incident involving Beacon, the customer relationship management (CRM) system used by the Trust.

Beacon notified Arnos Vale Cemetery Trust about the incident on Monday 3 August.

Beacon backs up our data daily, and therefore the data potentially involved is everything that was held in Beacon as at Monday 27 July when Beacon say the attack occurred. This means that some personal information held by Arnos Vale Cemetery Trust in Beacon may have been affected.

The Trust understands that this may be concerning and is taking the matter seriously.

What happened?

Beacon has advised that it experienced unauthorised access to its systems. It has taken immediate steps to investigate the incident and secure its systems.

These measures include:

• Conducting a forensic investigation with independent cyber-security specialists to establish what happened and determine what information may have been affected.
• Working with law enforcement and relevant regulators where appropriate.
• Monitoring the dark web and other online sources for any indication that personal data has been published or misused. At present, Beacon has advised that it has found no evidence that any data has been shared or published.
• Implementing additional security measures to help prevent further unauthorised access.

Further information about the incident and Beacon’s response can be found here: https://www.beaconcrm.org/incident

What information is held in Beacon?

Beacon is the system Arnos Vale Cemetery Trust uses to keep track of people who use or engage with our services. This includes people who have made wedding enquiries, arranged funeral services, hired our venues, booked tickets for events, made donations, subscribed to our newsletter, or otherwise been in contact with the Trust.

Beacon also records information about transactions and bookings, but it does not process payments.

For most people, the information held in Beacon may include a name and email address, and where applicable, an address and telephone number.

Where someone has made a donation, Beacon records information such as the date and amount of the donation. Where a regular donation has been set up through our website and paid by card, Beacon may also hold a reference number that links the donation to our payment provider. This reference number cannot be used to move money or access a bank or payment account.

Importantly, Beacon does not hold bank account numbers, sort codes or card details.

Payments made through our website are handled securely by our payment provider, and standing orders are set up directly with the donor’s own bank. Beacon does not process or store these payment details.

For event bookings, Beacon may therefore contain information such as the event or service booked and the amount paid, but it does not hold the bank or card details used to make that payment.

What is Arnos Vale Cemetery Trust doing?

Beacon has confirmed that the incident did not originate from Arnos Vale Cemetery Trust’s own systems.

As an additional precaution, the Trust has reviewed its own security measures and staff passwords have been reset.

The Trust has also contacted people held on its systems for whom it has an email address, notifying them of the incident and providing advice on steps they can take to remain vigilant.

At this stage, there is no evidence that personal information has been misused. The Trust will continue to monitor the situation and provide further updates as confirmed information becomes available.

What can you do?

Although there is currently no evidence that personal information has been misused, supporters are advised to remain vigilant for unexpected emails, telephone calls or messages claiming to be from Arnos Vale Cemetery Trust or requesting personal or financial information.

If a communication appears suspicious:

• Do not click on links or open attachments unless the communication has been verified as genuine.
• Do not provide personal or financial information in response to an unexpected request.
• If in doubt, contact Arnos Vale Cemetery Trust using its usual contact details before taking any action.

People who have received an email directly from Arnos Vale Cemetery Trust about this incident should follow the advice provided in that communication.

Further information

Arnos Vale Cemetery Trust is committed to keeping supporters informed and will provide further updates when confirmed information is available.

Any questions or concerns can be directed to the Data Protection Officer at dpo@arnosvale.org.uk.