London property manager breach may have exposed bank details and lockbox codes

London property manager City Relay says attackers exploited a Metabase Cloud vulnerability twice, stealing landlord bank details, passwords, and lockbox codes.

City Relay, which manages thousands of London properties, told landlords that intruders accessed its third-party Metabase Cloud instance twice via an undisclosed vulnerability and extracted personal data, including names, addresses, phone numbers, bank account numbers, sort codes, IBANs, SWIFT references, account passwords, and key-storage locations with lockbox codes. The company reportedly learned of the intrusion on September 8, notified customers on September 14, and says it has rotated all exposed access and key-storage codes, with no evidence of data misuse or unauthorized property entries so far. Metabase disclosed a zero-day SQL injection flaw on August 6 that compromised fewer than 3% of its customers, with Framework and n8n as known victims, though it has not confirmed City Relay was part of that campaign.