Originally published at ictcrm.com Short answer: the CRM software was not broken. In the biggest CRM breaches of 2026, attackers turned up holding a valid credential or an OAuth token nobody had revoked, then used ordinary product features to pull data out in bulk. No patch would have stopped any of it. Knowing what still holds a key to your system would have. Beacon CRM is the one in the news this week. The London company runs a cloud CRM used by more than 1,000 charities for donatio...