Poppins Payroll Data Breach Investigation: Edelson Lechtzin LLP Probes Class Action Claims After Customer Data Is Exposed

National class action law firm offers free, confidential case evaluations to household employers and household employees whose personal information may have been exposed in the Poppins Payroll data breach.

NEWTOWN, Pa., Oct. 2, 2026 /PRNewswire/ -- Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the Poppins Payroll data breach. Anyone who received a breach notice, or who believes their personal information was exposed, can request a free case evaluation.

Poppins Payroll data breach — at a glance

• Company: Poppins Payroll is a Boulder, Colorado-based, cloud-based service for managing household employee payroll and taxes.
• Reported: Poppins Payroll sent notification letters dated September 29, 2026, and reported the incident to the California and Vermont Attorneys General beginning September 29, 2026.
• How it happened: An unauthorized third party exploited a security vulnerability in Metabase, a software vendor used by Poppins Payroll, to access one of the company's systems.
• When: Poppins Payroll detected the unauthorized access on September 3, 2026, and reported that it occurred the same day.
• Who may be affected: Household employers who use Poppins Payroll and the household employees paid through its service.
• Status: The incident's full nationwide scope and the attacker's identity have not been publicly confirmed.
• Cost to you: Nothing. Click here for a free evaluation.

What Happened

On September 3, 2026, Poppins Payroll detected that an unauthorized third party had gained access to one of its systems after exploiting a security vulnerability in Metabase, a software vendor the company uses. The company addressed the vulnerability, engaged an outside security firm, and determined that affected individuals' personal information may have been accessed or acquired that day. Its filing with the Vermont Attorney General identified 333 affected Vermont residents; the nationwide total has not been publicly confirmed.

What Personal Information May Be at Risk

Based on public accounts and regulatory filings, the information potentially involved varied by individual. Depending on what each person had provided to Poppins Payroll, the data that may have been compromised includes full name, Social Security number, date of birth, home address, phone number, wage and compensation information, tax return information, direct deposit and other financial account details, and credit and debit account information.

Your Legal Options

Edelson Lechtzin LLP is investigating a potential class action on behalf of individuals whose personal data may have been compromised. A successful case could recover compensation for losses such as lost time, out-of-pocket costs, and loss of privacy, and could push Poppins Payroll to strengthen how it protects personal information. Anyone who received a breach notification is encouraged to come forward. The firm will evaluate your rights and potential claims at no cost.

Recommended Steps to Protect Yourself

Enroll in the complimentary protection Poppins Payroll is offering: 24 months of credit monitoring and identity protection through Experian IdentityWorks, using the activation code and deadline in your notification letter.

• Preserve any breach letters or emails, and monitor your account statements and credit reports for suspicious activity.

Consider placing a fraud alert or security freeze with Equifax, Experian, and TransUnion.

Guard against tax fraud by filing early and requesting an IRS Identity Protection PIN.

Be cautious of calls, texts, or emails referencing this breach. The company's notice includes a dedicated call center for questions.

Contact Us for a Free Case Evaluation

Speak confidentially with a data privacy attorney today: Marc Edelson, Esq., Edelson Lechtzin LLP, 411 S. State Street, Suite N-300, Newtown, PA 18940; Phone: 844-696-7492; Email: [email protected]; Web: www.edelson-law.com.

About Edelson Lechtzin LLP

Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud.

Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions. Prior results do not guarantee a similar outcome. The data breach described above is based on Poppins Payroll's notification letters and its filings with state regulators; certain details, including the full nationwide scope, remain unconfirmed.

SOURCE Edelson Lechtzin LLP