2026 Poppins Payroll — Metabase vuln Sep 3; SSNs/payment data; ≥333 VT residents
Data compromised
Social Security numbers, financial account codes, and credit/debit account information (company notice via Claim Depot / state AG summaries)
Technical writeup
Verified company/state AG disclosures — Poppins Payroll (Boulder, CO household payroll) detected unauthorized access on September 3, 2026 via a Metabase vulnerability; intrusion and discovery same day. Notices to California and Vermont AGs ~September 29; Vermont filing identifies 333 residents (catalog recordsAffected 333 as attested floor; nationwide may be higher). Offers 24 months Experian IdentityWorks. companyConfirmed true.
Root cause
Security vulnerability in Metabase exploited for unauthorized access to a Poppins Payroll system (same-day discovery Sep 3, 2026 — company/state filings)
References
- https://www.claimdepot.com/data-breach/poppins-payroll-2026
- https://ago.vermont.gov/categories/security-breach-notices
- https://oag.ca.gov/ecrime/databreach/reports/sb24-630541
- https://www.prnewswire.com/news-releases/poppins-payroll-data-breach-investigation-edelson-lechtzin-llp-probes-class-action-claims-after-customer-data-is-exposed-302897583.html