London property manager breach may have exposed bank details and lockbox codes

Your bank details and property access codes could be exposed if you are a City Relay customer.

London property management company City Relay has alerted its clients to a potential data breach after intruders accessed its Metabase Cloud instance twice. The company stated that personal data, including financial information such as bank account numbers and sort codes, alongside property access details and passwords, was extracted. The breach may have also exposed information about property amenities and the locations or codes for lockboxes used to store keys. City Relay informed affected landlords and former users via email, stating the attackers exploited a previously unknown vulnerability in the Metabase platform. The company has since updated access and key-storage codes and is investigating the full scope of the incident with cybersecurity specialists and authorities, though it has found no evidence of unauthorized property access.

The breach at City Relay highlights the cascading risk introduced by third-party data platforms like Metabase, especially when these tools are granted broad access to sensitive databases. The incident underscores the critical need for organizations to meticulously audit the permissions and data exposure levels of integrated services. It also points to a potential gap in cloud platform security awareness, where 'vulnerabilities in the platform that we were unaware of' can have severe consequences for end-users.

This event serves as a stark reminder that even seemingly benign analytics tools can become vectors for significant data exfiltration if not configured with stringent security protocols. The exposure of lockbox codes and property access details presents an immediate physical security risk, beyond the typical concerns of identity theft or financial fraud. It suggests a need for property management firms to re-evaluate their reliance on such platforms and perhaps implement stricter segmentation for data accessed by external tools.