Poppins Payroll, a Boulder, Colorado-based company providing payroll and tax services for household employers, disclosed a data breach to the Vermont Attorney General on September 30, 2026. The incident reportedly stemmed from a vulnerability in Metabase, a software vendor used by Poppins Payroll, with unauthorized access occurring on September 3, 2026.
At least 333 Vermont residents were affected by the breach. The exposed data types include Social Security numbers, financial account codes, and credit and debit card information. While California was also reportedly notified, the number of affected residents in that state remains unknown. No official company statement outside of notification letters has been located, but Poppins Payroll reportedly established a dedicated call center and offered 24 months of Experian IdentityWorks credit monitoring to affected individuals.
Details surrounding this incident, including the full scope of affected individuals across all states, may continue to emerge as investigations progress. Specific dates for consumer notification have not been publicly confirmed.