Poppins Payroll data breach: what to do now

What happened

Poppins Payroll says an unauthorized third party exploited a security flaw in Metabase, a software tool from an outside vendor, to access a Poppins system on September 3, 2026. The company says outside security experts confirmed there is no current threat from the flaw, and that it has no evidence the information has been used for fraud.

A Metabase security flaw was also behind a recent breach at Blueberry Pediatrics.

Poppins hasn't published a total. Breach filings with several states add up to about 247,000 people. Because Poppins handles payroll for households, people affected may include both the families who use Poppins and the nannies, caregivers, and other workers they pay.

What information was exposed

• Name
• Date of birth
• Social Security number
• Financial account information, including credit or debit card information for some people

This list comes from Poppins' filings with state attorneys general. Exactly what was involved varies by person, and your notice letter lists your information.

What to do now

1. Enroll in the two years of free Experian IdentityWorks credit monitoring offered in your letter. Use the activation code and enrollment deadline printed in it.
2. Consider a free credit freeze at Equifax, Experian, and TransUnion. It stops anyone from opening new credit in your name, and you can lift it any time.
3. Check your bank and card statements, and contact your bank about any charge you don't recognize.
4. If you're a household worker, watch for an IRS letter about a tax return you didn't file. You can get an Identity Protection PIN at IRS.gov to stop someone from filing a return in your name.
5. Watch for scam calls, texts, and emails that mention this breach. Scammers often pose as Poppins, Experian, or the IRS or a "breach settlement" service. Don't share passwords, codes, or payment details, and contact Poppins, Experian, or the IRS using a number you look up yourself.

Ask Poppins Payroll to delete your data

Fewer copies of your information means less to steal next time. Payroll and tax records must generally be kept for several years under tax law, so Poppins may not be able to delete those. Other information may still be deletable, and Poppins says it responds to privacy requests within 45 days.

Your legal right to deletion

If you live in a state with a consumer privacy law, such as California, Colorado, Connecticut, Maryland, Minnesota, or Oregon, Poppins Payroll generally has to respond to your deletion request within the deadline your state sets, though it can keep records the law requires it to keep. See what your state's law requires.

Sources: California Attorney General breach notice, Poppins privacy policy, and state breach filings compiled by ClaimDepot. DataTrail isn't affiliated with Poppins Payroll. This page is general information, not legal advice.