London property manager breach may have exposed bank details and lockbox codes
City Relay says intruders accessed its Metabase Cloud instance twice and extracted customer data
London-based property management firm City Relay has alerted its customers to the potential theft of financial data and sensitive property information. The company discovered that intruders had breached its Metabase Cloud instance, likely due to an undisclosed vulnerability. City Relay warned that customer names, email addresses, physical addresses, phone numbers, financial information, property access details, and account passwords may have been compromised.
The stolen data also included bank account numbers, sort codes, IBANs, SWIFT references, and account names and addresses. Attackers may have obtained details about property amenities and access, including lockbox codes. Dray Agha, senior manager of security operations at Huntress, explained that the exposed information depends on the level of access granted to Metabase by each customer.
If passwords and financial details were stored in plaintext, it would indicate poor data protection practices. City Relay notified both current and former customers via email, stating that they had already updated access and key-storage codes following the incident. They advised customers to monitor their bank accounts for suspicious transactions, watch for phishing scams, and change any reused passwords.
The company has not confirmed if the attack has led to any misuse of the exposed data. City Relay manages numerous London properties and has hundreds of partners, operating in both London and Paris. The full extent of the attack is still under investigation.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
