As cited
Copy frozen at (site build).
vulnerabilities
London property manager breach may have exposed bank details and lockbox codes
City Relay, a London property manager, disclosed a breach of its Metabase Cloud instance that exposed customer names, addresses, financial data including bank account numbers and sort codes, passwords, and property access codes for stored keys. The company learned of the intrusion on September 8, 2026, notified customers on September 14, and immediately updated access codes, reporting no evidence of unauthorized property access or data misuse to date. The breach stemmed from a vulnerability in Metabase that the company was unaware of, though the specific flaw has not been identified.
Why it matters: London landlords and property managers using City Relay must verify their bank accounts for fraudulent activity, reset passwords across other services, and monitor for phishing attacks; the exposed lockbox codes, though rotated, represent a physical security risk that requires verification of property access.
- Source published
- First seen by Cybersecurity Tracker