One Metabase vulnerability, three notices: what two filings show

What the two documents are

The question assumes three separate breach notices tied to one Metabase vulnerability. The materials supplied hold two documents, covering two of the three organizations. One is a notice letter from Poppins Payroll Company to affected individuals. The other is a California Attorney General breach record for Blueberry Pediatrics. No letter from a clinical software vendor was supplied, so this guide cannot describe one. Where the documents are silent, the guide says so rather than filling the gap.

What the Poppins letter says happened

The Poppins letter opens by telling recipients it concerns a data security incident.

The letter says an unauthorized third party used a vulnerability in Metabase to reach a Poppins system. The letter calls Metabase "a software vendor." It does not describe the product as an analytics tool.

The letter gives the detection date as September 3, 2026.

The letter says Poppins addressed the vulnerability and then brought in outside investigators.

On the investigation's result, the letter uses cautious wording. It says the personal information "may have been accessed or acquired," on the same date as detection. The letter does not state that data was confirmed taken.

What data was exposed

The Poppins letter does not make the exposed data types visible in the copy supplied. The sentence meant to introduce them is cut off. The list that should follow is missing, and the supplied copy appears to be a redacted proof.

One point could be misread. The letter's credit freeze instructions mention Social Security numbers, but only as something a person must give the credit bureaus. That sentence describes what a freeze request needs. It does not say what was exposed.

The letter also does not give the number of people affected. It does say Rhode Island residents were among them.

On misuse, the letter says Poppins has no evidence so far.

The Blueberry Pediatrics record does not state any data types. The page supplied does not include the text of the notice.

The Blueberry Pediatrics record

The California Attorney General record names the organization and a breach date.

The record also points to a sample notice by file name. The file name contains the word "Photon." The record does not say what Photon is, so this guide does not treat it as a vendor, a product or anything else.

The page supplied does not mention Metabase. It does not name a clinical software vendor, and it does not say how the breach happened. Nothing in these two documents lets a reader confirm that the Blueberry notice and the Poppins notice come from the same vulnerability.

Who notified whom, and when

The Poppins letter is written by Poppins to individuals. It says Poppins itself found the unauthorized access. The letter does not say Metabase told Poppins about a problem. It also does not mention any other company affected by the same flaw.

The letter does describe what Poppins is doing about its vendor. It says it started a review of Metabase's practices.

It also reports a result from outside experts about the vulnerability.

For Blueberry Pediatrics, the record shows only the organization, a breach date and a sample consumer notice. It does not say whether a vendor, a software provider or Blueberry itself first found the problem. It also does not say who told whom. The chain in the question (a vendor notifying a practice, or a practice notifying families) cannot be shown from these documents.

Timeline from the documents

• Sunday, August 9, 2026: the breach date on the Blueberry Pediatrics record.
• September 3, 2026: Poppins says it detected unauthorized access, and that the same date is when data may have been accessed.
• September 29, 2026: the date on the Poppins letter.

The Blueberry date is earlier than the Poppins detection date. The documents do not say whether the two events are connected. The Blueberry record also marks its breach date as "if known," so the field may be an estimate.

What Poppins offers recipients

The Poppins letter offers two years of free protection services. It names the provider as Experian.

The letter lists the services.

It also gives steps people can take on their own. It recommends a one-year fraud alert.

It warns about the order of two steps. A security freeze placed before enrollment must be lifted to sign up for the monitoring.

What these documents do not settle

Three parts of the question stay open on this record:

• The shared cause. Only the Poppins letter names Metabase. The Blueberry record does not.
• The third notice. No clinical software vendor letter was supplied.
• The data exposed. The Poppins data list is not visible in the copy supplied, and the Blueberry record gives no data types.

A complete account would need the vendor's own notice and the full text of the Blueberry consumer letter. Until then, the Poppins letter is the only document here that ties an incident to a Metabase vulnerability, and it gives a detection date of September 3, 2026.