City Relay Hit by Double Metabase Breach Exposing Financial Data and Lockbox Codes

City Relay, a London property manager overseeing thousands of apartments across the British capital and Paris, has notified clients of a double compromise of its Metabase Cloud instance. The intrusion, discovered on September 8, 2026 and disclosed to clients on September 14, potentially exposed financial data, access credentials, and — in an unusual twist for a data breach — lockbox codes and physical key locations for managed properties. The incident raises questions about the security of cloud analytics platforms connected to unsegmented transactional databases.

The Double Access and Exposed Data

In an email to clients seen by The Register, City Relay stated its instance on a "third-party platform" was "accessed [...] twice" due to a vulnerability "of which we were unaware." The word "twice" is significant: this was not a single event, but repeated accesses to the same infrastructure.

The source disclosed the exact list of data at risk. Beyond names, email and physical addresses, phone numbers, and account passwords, the exposure covers "bank account numbers, sort codes, IBANs, SWIFT references, and account names and addresses." More unusually, City Relay acknowledged that "locations of stored keys and codes for lockboxes containing them" were included in the data accessible through the compromised platform.

The company said it had "immediately took precautionary action to update the relevant access and key-storage codes," noting the previous codes "can no longer be used." City Relay added it has no "evidence of any unauthorised property access arising from the incident." The statement does not rule out that the codes were copied, but asserts they have not been used for physical intrusions.

The Technical Attribution Chain Remains Open

The Register attempted to link the incident to a zero-day SQL injection disclosed by Metabase on August 6, 2026, which the outlet said had hit "less than 3% of customers." Metabase has not confirmed this link.

Separately, CVE-2026-27464 was published on September 16, 2026 in the National Vulnerability Database with a CVSS 3.1 HIGH rating. The NVD entry describes a template injection in Metabase that allows a low-privileged user to extract database credentials — a condition that could technically open a path to backend access. However, the GitHub advisory GHSA-vcj8-rcm8-gfj9, dated February 19, 2026, documents a template injection in the notifications endpoint with a different mechanism than the August SQL injection. The fix is available in versions v1.57.13 and v1.58.7.

The dossier does not establish which vulnerability actually hit City Relay. The discrepancy between the flaw type mentioned in press reports (August zero-day SQL injection) and the one documented in CVE-2026-27464 (February template injection) remains unresolved. City Relay itself used a generic formulation — "a vulnerability in the platform that we were unaware of" — without specifying an identifier or class.

"As property access and key-storage information was potentially included, we immediately took precautionary action to update the relevant access and key-storage codes" — City Relay, client email cited by The Register

The Technical Reading: When the Transactional Database Mirrors in Analytics

The incident serves as a case study in the misconfiguration of cloud business intelligence platforms. Dray Agha, a Huntress researcher cited by The Register, distinguished two scenarios: "A company linking Metabase to a general analytics database will only expose harmless user metrics. A company that connects it directly to their core transactional database risks exposing highly sensitive financial records and credentials." His observation does not assign blame to Metabase as a product, but highlights an architectural choice: the failure point is the lack of segmentation between the analytics layer and the transactional layer.

Agha added that "sensitive financial details should also be encrypted or tokenized when held in a database. Keeping this information readable creates a massive risk if a connected reporting tool is ever compromised." The quote is a general recommendation on best practices, not a documented finding on City Relay's specific implementation. The dossier does not establish whether the banking data was encrypted, tokenized, or stored in plaintext in the database upstream of Metabase.

The technical core, however, remains documented: a Metabase Cloud instance connected to a database that simultaneously contained financial data and physical access credentials. The compromise of a single endpoint exposed two traditionally separate security domains — cybersecurity and physical security — through a single attack surface.

What to Do Now

For City Relay users, the documented actions are immediate and specific. The company has already deactivated the exposed lockbox codes and replaced them: clients must verify they have received the new codes and report any anomalies in property access. For account credentials, password rotation is recommended, given that account passwords were included in the data at risk.

For financial data, monitoring bank statements is the practical measure indicated: the exposure of IBANs, sort codes, and SWIFT references opens the door to banking fraud or social engineering attempts. City Relay has not indicated credit monitoring services or reimbursement for potential losses.

For operators using Metabase Cloud, the case documents three concrete checks. Verify that the Metabase instance is not connected directly to transactional databases containing financial or physical access data: segmentation between analytics and transactional layers is the barrier that would have limited impact. Confirm the version in use is updated beyond v1.57.13/v1.58.7, the fix for the template injection documented in advisory GHSA-vcj8-rcm8-gfj9. Monitor Metabase advisories for the August 2026 zero-day, given the link to the City Relay incident is not excluded but not confirmed.

Questions and Answers

Is it confirmed that CVE-2026-27464 is the vulnerability used in the attack?
No. CVE-2026-27464 documents a template injection in Metabase with credential extraction, but neither Metabase nor City Relay have confirmed this is the flaw exploited. Press reports also mention an August 2026 zero-day SQL injection, without resolving the discrepancy.

Were the lockbox codes actually used for intrusions?
City Relay stated it has no evidence of unauthorized property access. The exposed codes have nevertheless been deactivated and replaced.

How many clients were affected?
City Relay has not disclosed a number. The Register, while citing an internal source, has not published an independent figure.

Sources

• https://www.theregister.com/security/2026/09/17/london-property-manager-breach-may-have-exposed-bank-details-and-lockbox-codes/5297232
• https://en.cryptonomist.ch/2026/09/17/london-property-data-breach/
• https://coindesk.cc/london-property-data-breach-exposes-bank-details-and-lockbox-codes-115467.html
• https://nvd.nist.gov/vuln/detail/cve-2026-27464
• https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9
• https://t.co/WydnOZB0FE
• https://www.welivesecurity.com/en/eset-research/beware-sparrowock-backdoor-bites-commands-catch/#Backdoor%20commands

Information verified against cited sources and current as of publication.

Sources