Poppins Payroll Data Breach: A Vendor's Metabase Vulnerability

According to Newsweek, PR Newswire releases from law firms, and breach filings, Poppins Payroll detected unauthorised access on September 3, 2026. Notification letters dated September 29 said an unauthorised party exploited a vulnerability in Metabase, software used by a vendor, to reach one of the company's systems. Notifications went to attorneys general in several states, including California, Indiana, Massachusetts, Oregon, South Carolina, Texas, Vermont and Washington.

The notice lists names, Social Security numbers, dates of birth, addresses, phone numbers, wage information, tax return information, direct deposit and financial account details, and card information as potentially exposed. Payroll data combines identity and financial details in one place.

Filings in Massachusetts and Vermont, cited by ClaimDepot and law firms, list 8,428 people. The company has not published a national total, and tracker figures compiled from state filings have not been confirmed by it. The company has said more than 65,000 families have used its service since 2016, which is a customer history figure, not an affected count.

The specific Metabase vulnerability or CVE had not been named in the reporting reviewed. Metabase has had serious vulnerabilities in the past, which reinforces the need for prompt patching and network restriction of analytics tools.

Business intelligence tools connect directly to databases and often store connection credentials. A vulnerability in an internet-exposed instance can give attackers query access to everything the tool can reach. The Double Counter breach the same season also began with an exposed Metabase instance, according to reports.

When a vendor runs tools connected to your data, their patching and exposure become your risk. Contracts should require timely patching, restrict internet exposure, and give you visibility into the vendor's security practices for systems touching your data.

Place analytics tools behind single sign-on and private network access, not public login pages. Give them read-only database users scoped to the data needed, and avoid connecting them to tables containing SSNs and bank details unless essential.

Encrypting or tokenising SSNs and bank account numbers at the field level means a query tool reading the database sees protected values. This limits the impact of analytics compromises without blocking reporting needs.

Household payroll services handle data for both employers, typically families, and their employees, such as nannies and caregivers. Both groups may receive notices, and household employees may be less likely to monitor tax or credit accounts closely.

The company offered 24 months of Experian IdentityWorks, according to reports. Several law firms announced investigations; filed suits had not been confirmed in the reporting reviewed.

Enrol in monitoring, consider a credit freeze, watch for tax return fraud and request an IRS identity protection PIN if available to you, and monitor bank accounts used for direct deposit.

Detection September 3, letters dated September 29, filings from September 29, 2026.

Analytics tools hold the keys to production data. Patch them, hide them, scope them, and protect sensitive fields.

Ask vendors which third-party tools touch your employees' data, whether analytics tools are internet-exposed, how quickly they patch critical vulnerabilities, whether sensitive fields are encrypted, and how fast they will notify you. Payroll providers hold some of the most sensitive data about your workforce.

Payroll data with SSNs and wage information is ideal for filing fraudulent tax returns. Affected people should file early where possible, use IRS identity protection PINs, and watch for notices about returns they did not file.

Continuous external scanning finds internet-facing tools, including vendor-operated ones on your domains, and flags known-vulnerable versions. It is one of the few controls that catches forgotten or vendor-managed exposures before attackers do.

Small payroll and HR providers hold the same sensitive data as large ones but with smaller security teams. Customers choosing such services should ask direct questions about security practices rather than assuming size reflects risk.

Patch analytics tools quickly, keep them off the public internet, give them least-privilege database users, tokenise sensitive fields, and scan your external surface continuously, including vendor-run systems.

The investigation and state-by-state notifications were still ongoing at the time this was written.