How charities should respond to a data breach

For charities, the data they hold will depend on their purpose, strategic aims and the people they support.

You may think that if your system is run by a third party, that is super secure, you are okay. But what happens when that provider suffers a data breach and the full implications, including what information may have been accessed or downloaded, are not yet known?

That is what appears to have happened with the breach at Beacon, a customer relationship management (CRM) provider used by more than 1,000 charities.  

Many affected charities have contacted members to tell them about the breach and explain what information they hold about them. I have been contacted by a couple of charities who I use in relation to my little girl, who has a complex, rare, life-limiting condition.

So what would I say to charities affected by the breach, and to Beacon? 

As a crisis communications consultant and strategic adviser, I would say stick to the facts. Explain what is known, what is not known, what you can say, and why you can’t say more. Be honest, transparent, and authentic. Explain the steps you are taking to manage the situation and take ownership of what has happened.

Above all, avoid creating an information vacuum and be clear, consistent, and compassionate in your message.

Adapt your communications for different audiences and acknowledge that something like this can leave people feeling worried and fearful. Tell them what you are doing, what they should do and when they can expect to hear from you again. And if you have no further information, tell them that too.

For charities, it is important to explain what data you hold on people, why you hold it and what steps they need to take to protect themselves. 

Why crisis communications matters for charities

Crisis communications can feel like a luxury or an unknown for smaller charities. But the ability to communicate effectively during a crisis is crucial to navigating it and maintaining confidence. I feel strongly about this because I love what charities have done to support us; I like supporting them, and I know how important communications are during a crisis, both for the organisation affected and their members.   

When I heard about the Beacon breach, it really bothered me. Both from a crisis communications point of view and as a parent whose data may have been compromised. 

When a data breach affects vulnerable people

I was at the hospice with my little girl when I found out. Two charities contacted me to tell me they had been affected. I felt terrible in case the hospice was affected. I still don’t know whether it was. But what I do know is other charities working with vulnerable families have been affected.

Charities that do amazing work and who probably don’t think about crisis communications and data breaches from third-party systems they use that much. I mean, why would they?

Their main vision and strategy is around helping service users who access their charity in a time of real need. Not least, vulnerable families who are going through devastating situations.

I want to help charities that have been affected, because they use the CRM for a multitude of reasons, either by giving them some advice or helping them navigate the breach with stakeholders.

I want to do that because I am passionate about crisis communications and equally passionate about supporting charities. 

Rebuilding trust after a breach

A crisis of this nature can really affect trust, especially if that charity holds sensitive information or is working with vulnerable parents, carers, children and young people, or victims of crime or domestic abuse. How these organisations respond will be critical to rebuilding trust and recovering from the breach.

I know charities don’t necessarily approach crisis communications in the same way as large private companies or high-profile consumer brands. But a crisis can affect any organisation, and it can have a significant impact on public perception, trust and confidence. 

This Beacon scenario is a perfect example. It made me think about hospices and charities supporting parents of children with serious illnesses, people living with serious conditions and other vulnerable groups. These organisations need to ensure their crisis communications are robust enough to deal with an incident of this nature, particularly if this story gains wider attention. It amazes me it hasn’t already. 

Charities can continue doing excellent, purposeful and impactful work while also having their members’ confidence shaken by a data breach. Both things can be true at the same time.  

The question is how to navigate your way out of the crisis.

Organisations will be judged by how they handled a situation when in the spotlight, during a crisis, and how they navigate their way out of that, and by how they effectively bring their audiences and stakeholders with them as they recover.

That means understanding, valuing and using crisis communications before you need it. For charities dealing with sensitive information, it can be the difference between confidence collapsing and confidence being sustained and rebuilt. 

Dee Cowburn is director of Dee Cowburn Communications, a communications consultancy specialising in crisis communications and media relations for private, public sector and charities. With two decades of experience in high-risk political environments, she was previously head of communications in policing and crime for the Mayor for West Yorkshire, a former investigative journalist and is also a specialist partner with crisis communications agency Alder. Responsible for all communications from a political perspective around international stories, including the murder of an MP in West Yorkshire, a teacher killed in her classroom, a police officer shot as they carried out inquiries, and many other high-profile stories affecting communities. Dee has also worked with Together for Short Lives around the Assisted Dying Bill and is a trustee of Rett UK.

Further reading

Cyber crisis communications – a framework for communicating in the event of an attack

Navigating the storm: why crisis PR is essential for every brand

10 phrases that should (probably) never appear in your crisis communications