City Relay, a London-based property management firm, warned customers that attackers accessed its Metabase Cloud instance twice and extracted personal and financial data.

The company, which describes itself as "London's most trusted property management company," notified landlords via email that the breach occurred due to a vulnerability in the cloud platform. The intrusion was discovered on September 8, with notifications sent on September 14.

Compromised data included names, contact information, financial details such as bank account numbers, sort codes, IBANs, SWIFT references, and property access information, including locations of stored keys and lockbox codes. City Relay stated that the exposed financial data was extracted from the platform.

Dray Agha, senior manager of security operations at Huntress, explained that Metabase connects to users' databases, and the extent of exposed data depends on the access granted to it. If connected to a transactional database, sensitive financial records and credentials could be at risk. Agha noted that storing such information in readable form without encryption increases vulnerability if a connected reporting tool is compromised.

The company confirmed that no evidence of misuse of the exposed data has been found. It has updated access and key-storage codes and advised customers to monitor bank accounts for suspicious activity, watch for phishing attempts, and change reused passwords. City Relay is investigating the incident with cybersecurity specialists and authorities.

City Relay manages thousands of properties in London and Paris, though it has not disclosed the number of affected customers. The breach is under review, and the company has not identified the specific vulnerability exploited. Metabase had previously disclosed a zero-day SQL injection flaw in August, affecting fewer than 3 percent of its customers, though no direct link to this incident has been confirmed.

The incident highlights risks associated with third-party cloud platforms and the importance of robust data protection practices in managing sensitive information.