Poppins Payroll Suffered Data Breach
The company identified unauthorized access to customer records including Social Security numbers in September 2026.
Updated on Oct. 5, 2026 in Cybersecurity
Live Poll
Do you trust your payroll provider to keep your Social Security number and financial data secure?
Poppins Payroll detected a data breach on September 3, 2026, which exposed sensitive customer information including Social Security numbers and financial data. The company, which has served over 65,000 families since 2016, notified impacted individuals of the incident via letter on September 29, 2026.
Why it matters
The compromise of highly sensitive personal and financial identifiers creates significant long-term identity theft risks for thousands of families. Legal investigations into the breach suggest the incident may lead to class-action litigation regarding data security practices.
The breach resulted from unauthorized access through a security vulnerability found in Metabase software. Poppins Payroll has offered two years of credit monitoring to customers impacted by the incident.
The players
Poppins Payroll
This company provides payroll services for domestic employees and has served over 65,000 families since its inception.
The details
The unauthorized third party gained access to customer birth dates, financial account numbers, and Social Security numbers. While the company detected the breach on September 3, 2026, and alerted state regulators that same day, customers were not notified until September 29, 2026.
Timeline
2016: Poppins Payroll began providing services.
September 3, 2026: The company detected unauthorized access.
September 29, 2026: Customers received official notification letters.
The Tech Race
The incident highlights the ongoing security challenges posed by third-party integrations like Metabase software, which attackers frequently exploit to bypass perimeter defenses. This underscores a broader shift where vulnerabilities in shared infrastructure software can compromise entire user bases simultaneously.
Customers who have used Poppins Payroll should monitor their financial statements closely for unauthorized activity and initiate a credit freeze to mitigate identity theft risks. The provided two-year credit monitoring service should be activated immediately to provide early warnings of potential fraud.
The takeaway
Users of automated payroll services should regularly audit the third-party integrations their providers use to understand potential exposure points. If you are an affected customer, remain vigilant for phishing attempts that often follow official data breach notifications.
Further reading
For more information on current digital threats, visit the Cybersecurity section.
Source note: This article includes information reported by Newsweek.
Live Poll
Do you trust your payroll provider to keep your Social Security number and financial data secure?
