# London property manager breach exposes financial data and access codes Intruders accessed sensitive tenant and landlord information through a cloud platform vulnerability - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-09-17 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/b7eec3d7-808e-4bf1-bf00-fed65cd5f95e ## Breach scope and exposed data London property manager City Relay confirmed attackers accessed its Metabase Cloud instance, potentially compromising landlord and tenant data. The breach exposed names, contact details, financial information including bank account numbers and IBANs, plus property access codes. Attackers may have obtained lockbox codes and key storage locations, creating physical security risks alongside financial exposure. The company manages thousands of properties across London and Paris through hundreds of landlord partners. ## Attack vector and timeline Intruders exploited an unidentified vulnerability in the third-party Metabase Cloud platform twice. City Relay discovered the intrusion on September 8 and notified affected customers by September 14. The company immediately reset all compromised access codes and found no evidence of unauthorized property access. Security experts note the breach's severity depended on how customers configured their Metabase connections to core databases versus analytics systems. ## Security practices under scrutiny Huntress security analysts highlight concerning data protection practices, as the breach exposed readable financial details and passwords. Proper security would require encryption or tokenization of sensitive data. The incident reveals risks when reporting tools like Metabase connect directly to transactional databases without adequate safeguards. City Relay's claim as 'London's most trusted' property manager now faces credibility challenges following the security lapse. ## Potential link to known vulnerability Metabase disclosed a critical SQL injection flaw on August 6 that affected under 3% of customers before patching. While unconfirmed, the City Relay breach may relate to this zero-day exploit that also compromised Framework laptops and n8n automation platform. The property manager hasn't specified whether this vulnerability caused their incident, leaving questions about patch management timelines and third-party risk assessments. ## Customer response measures City Relay advised landlords and tenants to monitor bank accounts for suspicious activity, watch for phishing attempts, and change reused passwords. The company completed precautionary code resets but didn't disclose how many customers were affected across London and Paris operations. Ongoing investigations with cybersecurity specialists aim to determine full breach scope, while authorities have been notified about the data exposure incident. ## Broader industry implications This breach exemplifies growing risks in property tech ecosystems where management platforms aggregate sensitive access and financial data. The incident highlights how vulnerabilities in connected cloud services can cascade into physical security threats when key codes are exposed. Property firms face increasing pressure to implement zero-trust architectures as they digitize operations while managing physical assets. ## Data protection compliance questions The breach raises concerns about City Relay's GDPR compliance, particularly regarding storage of readable financial data and prompt breach notification. UK landlords and tenants may have claims if improper data handling contributed to the exposure. The six-day gap between detection and customer notification could face regulatory scrutiny, alongside questions about third-party vendor security assessments in the property sector. ## Long-term reputational impact For City Relay, which markets itself as London's most trusted property manager, the breach could significantly damage client relationships and new customer acquisition. The incident demonstrates how cybersecurity failures in proptech can erode trust more severely than in other sectors, given the combination of financial and physical security exposures. Competitors may leverage this event to highlight their own security protocols in a market where data protection is becoming a key differentiator. ## Sources covering this story - https://www.theregister.com/security/2026/09/17/london-property-manager-breach-may-have-exposed-bank-details-and-lockbox-codes/5297232 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._