London property manager breach may have exposed bank details and lockbox codes
London property manager City Relay says attackers exploited a Metabase Cloud vulnerability twice, stealing landlord bank details, passwords, and lockbox codes.
58
Organization
Framework
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 12, 2026
- Last mentionedSep 17, 2026
Timeline
5 articles · newest firstMathspace breach exposes data on over a million students and parents
Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.
72
Mathspace discloses data breach affecting over 1 million people
Mathspace disclosed a Metabase breach exposing data of 1,079,819 students, parents, and staff in Australia and New Zealand.
78
Trezor data breach impact now reaches 81,000 customers
Trezor's ShipMonk breach now affects 81,000 customers, adding 67,000 US customers after Metabase exploitation by ShinyHunters-linked attackers.
70
Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication
Metabase warns an actively exploited zero-day (CVE-2026-72898, CVSS 10.0) grants unauthenticated admin access; Framework, n8n, and Kilo Code disclosed data exposure.
90
Related CVEs
by mentions- CVE-2026-7289899%10.0Unauthenticated SQL Injection in Metabase Grants Admin Access
- CVE-2023-3864699%9.8Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's…
Appears with
- Metabasevendor · 5
- Metabaseproduct · 4
- Tallyorganization · 3
- Kilo Codeorganization · 2
- ShinyHuntersthreat actor · 2
- Frameworkvictim · 2
- n8norganization · 2
- Mathspacevictim · 2
- n8nvictim · 2
- Metabase Cloudproduct · 2
- Trezororganization · 2
- Huntressorganization · 1
- Metabaseorganization · 1
- City Relayorganization · 1
- Mathspaceorganization · 1
- CISAvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.