Important update: data security incident affecting our records system
We are informing our service users about a data security incident affecting Beacon, the records system we use to manage information about the people we support, including you. We take this extremely seriously and want to be honest and direct with you about what we currently know, what we don’t yet know, and what we’re doing about it.
What happened
On 4th August 2026, Beacon — the third-party software provider we use to store and manage participant records — told us they had identified unauthorised access to their systems by an external party. This was a breach of Beacon’s own systems, not of any system we manage directly, and Beacon has confirmed that this incident affected 1,500+ organisations who use their platform. It was not an attack targeted at The Parent Rooms specifically.
Beacon has since confirmed that copies of their database backups were made and were likely downloaded during this incident. They have told us that while data on their system is normally stored in an encrypted state, it is possible the unauthorised party could have decrypted it before taking a copy.
Beacon has been vague on the precise detail of what was accessed, and has told us they are unlikely to ever be able to establish this with certainty. Because of that uncertainty, we think it is right to tell you plainly: we cannot confirm whether your information was accessed, but we also cannot rule it out.
We are not saying this to alarm you. We are saying it because we believe you have a right to make your own informed decisions, and we would rather be direct with you than falsely reassuring. It’s also worth knowing that the case notes we keep on Beacon are deliberately light-touch and brief, rather than detailed clinical records.
What information this may include
The information we hold about you in Beacon may include:
- Your name and contact details (address, phone number, email)
- Details of your involvement with our services
- Case notes relating to the support you have received from us, which may include sensitive personal information you have shared with our team
As far as Beacon are currently aware, no financial or payment information has been accessed. We want to be careful here: this reflects what Beacon has told us so far, not a guarantee, since they have been unable to confirm the precise scope of what was taken. We will update you if this changes.
What we are doing
- We reported this incident to the Information Commissioner’s Office (ICO) on 4th August 2026, case reference IC-549040-B1Z0, and have met our reporting obligations in full.
- We have been in direct contact with Beacon, who have engaged external cyber-security experts, remediated the vulnerability that allowed access, and put additional monitoring in place across their systems.
- We have taken the decision to move away from Beacon to a new records system, and are now working on that transition.
- We are reviewing our own records to understand, as far as possible, whose information may have been affected and how, and we will contact anyone individually where we believe there is a specific risk to their safety or wellbeing.
What we’d suggest you consider
- Be alert to unexpected emails, calls, or texts claiming to be from us or referencing your involvement with our services, especially anything asking you to click a link, share personal details, or make a payment. We will never ask you for a password or bank details by email or phone.
- If you have any concerns about your personal safety as a result of this — for example, if you are worried about someone specific being able to access information about you — please contact us directly and confidentially at 02895 38 04 04 or michelle@theparentrooms.co.uk, and we will talk this through with you individually.
Your rights
You have the right to lodge a complaint with the ICO if you’re unhappy with how we or Beacon have handled this. Details are at ico.org.uk, or you can call their helpline on 0303 123 1113.
Questions
We know this raises questions we may not yet be able to fully answer, and we’re sorry for that. Please get in touch with Michelle Bradley (michelle@theparentrooms.co.uk / 028 95 38 04 04) and we will respond as quickly as we can. If you would prefer to speak to someone rather than write, that option is always available.
We are sorry this has happened. Protecting the trust you place in us is something we take extremely seriously, and we will keep you updated as we learn more.