Poppins Payroll Breach: Metabase Vendor Path

Poppins Payroll data breach: late September 2026 state filings tie roughly 247,000 people to a Boulder household payroll service after an attacker used a Metabase software vulnerability on September 3, 2026 — not a stolen nanny password. Corporate Breach walks the notice language, August 2026 Metabase industry warnings, connected-database risk, five-state AG letters, Texas and Indiana counts, Experian monitoring offers, and Edelson Lechtzin's Oct. 2 class-action investigation — concentration risk inside a $49-a-month nanny-tax niche. Figures from state filings, company notices, and public reporting unless noted. Which corporate failure should we open the file on next? Comment below. 0:00 Cold open — 247,000 records 0:29 Sep 3, 2026 — Metabase named 0:47 What Poppins Payroll does 1:11 Tax-grade identity in one database 1:31 Boulder household-employer brand 1:48 Household employer niche 2:09 First turn — not a stolen password 2:22 What Metabase is 2:51 Aug 6, 2026 Metabase alert 3:19 Connected database access 3:40 How it worked (flow) 4:00 Same-day access 4:25 Second turn — August warning, September hit 4:43 CVE industry parallel (not confirmed in notice) 5:14 Remediation list 5:38 No confirmed misuse yet (company) 5:54 Sep 29 letters and AG filings 6:14 Data categories exposed 6:41 Nanny and employer dual risk 7:09 State counts stack up 8:35 Third turn — 247,000 vs unconfirmed 8:37 Two years Experian monitoring 9:09 Oct 2 Edelson investigation PR 9:40 Concentration risk recap 9:47 Outro — next file Sources: California OAG notice (PDF) — https://oag.ca.gov/system/files/Redac... Metabase security update — https://www.metabase.com/blog/securit... AcidPeak notice rollup — https://www.acidpeak.com/notices/popp... Edelson Lechtzin PR — https://www.prnewswire.com/news-relea... Poppins Payroll — https://www.poppinspayroll.com/ Corporate Breach — cyber and corporate investigation docs. Altered/synthetic voice disclosure in Studio.