Poppins Payroll notifies customers of Metabase vulnerability breach

What the notice says

Poppins Payroll Company filed a notice with the California Attorney General, dated September 29, 2026, informing individuals about a data security incident involving personal information. The notice states that an unauthorized third party used a security vulnerability in Metabase, described as a software vendor used by Poppins Payroll Company, to access a Poppins system: .

Poppins Payroll Company says the activity was detected and the affected information may have been accessed on the same date: . The notice as filed does not specify in the provided text which categories of personal information were involved, stating only that the information depended on what was provided to the company.

After addressing the vulnerability, Poppins Payroll Company says it engaged outside help to look into the incident: . The company also describes steps taken afterward, including and other enhancements to its security perimeter and access controls.

Poppins Payroll Company is offering recipients complimentary services, stated as , including dark web monitoring and $1M per person in identity theft insurance.

What the notice leaves open

The notice as filed does not state a total number of affected individuals in the text provided. It also does not specify the exact data elements involved for this recipient, beyond noting that it depended on what information was provided to Poppins Payroll Company. The document does not state that information has been used fraudulently, noting .