City Relay
A rental application assembles close to a complete identity kit, passed through a referencing chain you didn't choose. What the check produced never expires: reports can be kept anonymised indefinitely, and your rent can end up on your credit file.
Reported incidents
Landlords' bank details and property lockbox codes taken from its data platform
2026-09-17Affected Metabase Cloud reporting instance
City Relay, a London property management firm for short and long lets, told customers on 14 September 2026 that personal data was extracted from its Metabase Cloud instance on two occasions, found on 8 September. The data included names, email and postal addresses, phone numbers, bank account numbers, sort codes and IBANs, account passwords, and property access details including lockbox codes. The company said it found "no evidence of any unauthorised property access" and that the codes were changed and "can no longer be used." It has not said how many people were affected.
People affected typically ask City Relay to confirm whether their information was included, and which categories.
The verified route
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.