HIV charity has 'sensitive' health data stolen

People using an HIV charity have been told their "sensitive and personal" health information may have been stolen in a data breach.

In an email sent to George House Trust users and seen by the BBC, the Manchester-based organisation said the material had been downloaded by hackers but not published.

The breach is part of a wider cyber security incident potentially affecting up to 1,500 charities across the UK.

George House Trust said it was investigating and "taking all appropriate steps".

The charity, which was set up in 1985, provides support, advice and information to thousands of people living with HIV.

It is unclear how many people connected to the trust have been affected by the breach.

The email said personal information including addresses, emails, telephone numbers and "notes and records" about users engagement with the charity was on the database that was targeted.

However, it said there was "no sign that any of the data or information" had been "misused in any way at this time".

The security incident involves technology company Beacon, which operates a database system used by more than a thousand charities across the country.

Beacon said the data breach happened at the end of July and it "immediately engaged external cyber security experts to help contain the incident and investigate".

The company said it was supporting all the organisations affected.

George House Trust said it was informed by Beacon about the breach on 3 August, although it was three weeks later that affected users were told.

The charity said it had waited until it had a "fuller understanding" of what had happened" before informing people.

In a statement, the charity said it had conducted a review of the data that Beacon holds and, where it identified sensitive data, it had "sought to inform the relevant individuals".