Published
October 15, 2026
People whose information was compromised in the September 2026 Poppins Payroll data breach, which Poppins traced to a vulnerability in Metabase, a software vendor it used, may be covered by a proposed class action alleging Poppins Payroll Company failed to protect their Social Security numbers and other personal information. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes proposed class action complaints. The statements below are unproven allegations. Poppins Payroll Company has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Poppins Payroll Lawsuits Are About
Poppins Payroll Company runs payroll and household tax software for people who employ nannies, senior caregivers, housekeepers or tutors in their homes. It is a Delaware corporation based in Boulder, Colorado. In a breach notice dated September 29, 2026, Poppins told affected people that an unauthorized third party had used a security vulnerability in Metabase, a software vendor Poppins used, to get into one of its systems, and that personal information may have been accessed or acquired on September 3, 2026.The first proposed class action over the breach was filed on October 2, 2026 in the U.S. District Court for the District of Colorado, No. 1:26-cv-04929. It alleges that Poppins did not adequately secure the personal information it held, did not detect the intrusion in time, and took several weeks to tell people. More suits followed on October 6, 2026, including Nos. 1:26-cv-04980, 1:26-cv-04983 and 1:26-cv-04994 in the same court.
The complaint names Poppins Payroll Company as the only defendant. It does not mention Metabase, and Metabase is not a party to that case. Poppins has not admitted wrongdoing, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Lawsuits Filed · Complaint Stage
First case No. 1:26-cv-04929 · D. Colo. · filed October 2, 2026 · no class certified
Breach Date
September 3, 2026
Access through a Metabase vulnerability, per Poppins’ notice · notice letters dated September 29, 2026
Can I Claim?
No — nothing to claim yet
No settlement, no claim form and no deadline
Timeline: From the Metabase Intrusion to the First Lawsuits
The dates below come from Poppins’ breach notice, the California Attorney General’s breach listing and the court docket.- September 3, 2026 — Poppins detects unauthorized access to a system, which its notice attributes to the Metabase security vulnerability. The notice says personal information may have been accessed or acquired that day, and the California Attorney General lists September 3 as the breach date.
- After detection — Poppins says it addressed the vulnerability and brought in an outside security firm to investigate.
- September 29, 2026 — Date on the sample notice letter Poppins filed with the California Attorney General.
- October 2, 2026 — The first class action complaint is filed in the U.S. District Court for the District of Colorado.
- October 6, 2026 — Further proposed class actions are filed in the same court, including Nos. 1:26-cv-04980, 1:26-cv-04983 and 1:26-cv-04994.
What Poppins Says Happened
Poppins’ notice describes the incident in a few sentences. An unauthorized third party exploited a security vulnerability in Metabase, a software vendor Poppins used, and reached a Poppins system. After it found the access on September 3, 2026, Poppins says it addressed the vulnerability, hired a third-party security firm, and determined through that investigation that personal information may have been accessed or acquired on the same date.The company says outside security experts have confirmed there is no current threat from the Metabase vulnerability. It lists the steps it has taken since, including starting a review of Metabase’s security practices and oversight, strengthening its security perimeter and system access controls, adding security testing and adding protections for data. As of the letter’s date, Poppins says it had no evidence that anyone’s information had been used for financial fraud or identity theft.
Poppins is offering people who received the notice two years of Experian IdentityWorks credit monitoring and identity protection at no cost. According to the notice, the package includes daily credit monitoring, dark web monitoring, identity restoration support and $1 million in identity theft insurance.
What Information Was Involved
The sample notice Poppins filed with the California Attorney General blanks out the list of affected data elements, so the public copy does not show what was involved for any one recipient. The first complaint, citing a California Attorney General breach report, alleges the information included:- Names and addresses
- Social Security numbers
- Dates of birth
- Financial account information
- Payment card information
The named plaintiff, a Virginia resident, alleges that her notice letter identified her Social Security number as part of the exposed information.
Who Is Affected
Neither the first complaint nor the posted sample notice gives a total number of people affected. The complaint describes them as thousands of individuals and alleges they come from across the United States. The sample notice ends with a line stating how many Rhode Island residents were affected, but the figure is blank in the public copy.The complaint describes class members as people who gave Poppins their personal information in order to receive its payroll services or software. Neither source says how the affected group divides between the households that use Poppins and the workers whose pay it handles.
What the First Complaint Alleges
The complaint’s core claim is that Poppins collected and stored sensitive personal information as part of its business and then failed to protect it with reasonable security. It alleges that Poppins did not spend enough on encrypting sensitive data, blocking outside access, detecting intrusions and training employees to recognize hacking threats. It relies on the Federal Trade Commission Act’s ban on unfair practices, as the FTC has applied it to inadequate data security, as a measure of the duty Poppins owed.Notice timing is a second theme. The complaint says Poppins did not disclose the breach for several weeks and that the delay made the harm worse. On information and belief, it also alleges that the attackers took the information off Poppins’ network and have misused it, including by marketing and selling it on the dark web. That allegation contrasts with Poppins’ statement that, as of its letter, it had no evidence of fraud or identity theft tied to the incident.
The complaint says the named plaintiff has spent time investigating the breach, reviewing account statements and taking steps to protect herself, and that she and other class members face an ongoing risk of identity theft and fraud, the loss of the benefit of their bargain with Poppins and a loss of value in their personal information.
The Proposed Class
The first complaint seeks to represent a nationwide class of all persons residing in the United States whose personal information was compromised as a result of the breach. The plaintiff reserves the right to amend that definition or propose subclasses later.Certification is requested under Federal Rules of Civil Procedure 23(b)(1), 23(b)(2) and 23(b)(3), as well as 23(c)(4), which allows particular issues to be certified. No class has been certified, and the definition in the complaint is only a proposal. The later-filed suits may define the class differently.
Claims and Relief Sought
The first complaint brings three counts on behalf of the proposed class:- Negligence, including a claim to the evidentiary presumptions of negligence per se based on the FTC Act
- Breach of implied contract
- Unjust enrichment, pleaded in the alternative
It asks the court to certify the class, award actual damages and restitution, and order Poppins to pay the cost of notifying class members and administering any claims process, along with interest, attorneys’ fees and costs. The unjust enrichment count seeks disgorgement into a common fund. The complaint also asks for injunctive relief, including periodic third-party security audits and penetration testing, automated security monitoring, segmentation of customer data, an end to sending or storing personal information in unencrypted email, deletion of data Poppins no longer needs, regular database scanning and ongoing security training. Its introduction adds long-term credit monitoring paid for by Poppins to the remedies sought.
The complaint alleges the amount in controversy exceeds $5 million, the threshold for federal jurisdiction under the Class Action Fairness Act, but it does not put a dollar figure on damages. It demands a jury trial.
The Cases in Colorado Federal Court
The first case, No. 1:26-cv-04929-RMR-CYC, is assigned to Chief Judge Regina M. Rodriguez, with Magistrate Judge Cyrus Y. Chung. The complaint says the case belongs in Colorado because Poppins’ principal place of business is in Boulder.At least three more proposed class actions over the same breach were filed in the District of Colorado on October 6, 2026. As of October 15, 2026, no order consolidating the Poppins Payroll cases had been located on the docket.
What Happens Next
When several class actions over one data breach land in the same federal court, the cases are commonly consolidated, and the court may appoint interim lead counsel for the proposed class. A consolidated complaint then usually replaces the individual ones. The defendant typically answers or moves to dismiss, and the court decides which claims, if any, go forward. Cases that survive move into discovery and, later, a contested motion for class certification.Many data breach class actions end in a negotiated settlement, but some are dismissed and the outcome of any one case is not predictable. If the Poppins Payroll cases settle, the court would have to approve the terms, and class members would generally receive notice and a chance to file a claim, object or opt out. None of that has happened.
Is There Anything to Claim?
There is nothing to claim. The cases are at the complaint stage, no class has been certified, and there is no settlement, claim form, settlement website or deadline. The credit monitoring described in Poppins’ notice letter is the company’s own offer and is separate from the lawsuits.Questions
Is there a Poppins Payroll data breach settlement?
There is no settlement. The proposed class actions over the September 2026 Poppins Payroll breach were filed in October 2026 in the U.S. District Court for the District of Colorado and are at the complaint stage. No class has been certified, and there is no settlement fund, claim form or deadline.
Is Metabase a defendant in the Poppins Payroll lawsuits?
The first complaint, No. 1:26-cv-04929, names Poppins Payroll Company as the only defendant and does not mention Metabase. Metabase comes into the story through Poppins’ own breach notice, which says an unauthorized third party used a security vulnerability in Metabase, a software vendor Poppins used, to get into a Poppins system.
What information was involved in the Poppins Payroll data breach?
The first complaint alleges the breach involved names, Social Security numbers, addresses, dates of birth, financial account information and payment card information. The list of data elements is blanked out in the sample notice Poppins filed with the California Attorney General, so the posted notice does not confirm which categories applied to any one person.
How many people were affected by the Poppins Payroll data breach?
Neither the first complaint nor the sample notice Poppins filed with the California Attorney General gives a total. The complaint describes the people affected as thousands of individuals but does not put a number on it.
When did Poppins Payroll find the breach and send notices?
Poppins’ notice says it detected unauthorized access on September 3, 2026, and that personal information may have been accessed or acquired that same day. The sample notice letter is dated September 29, 2026. The first complaint alleges Poppins waited several weeks to disclose the breach.
What is Poppins Payroll offering people who received a breach notice?
Poppins’ notice offers two years of Experian IdentityWorks credit monitoring and identity protection at no cost, including identity restoration support and $1 million in identity theft insurance. Enrollment details are printed in each person’s letter. The offer comes from Poppins itself and is separate from the lawsuits.
Sources
• Poppins Payroll data breach suits, D. Colo. No. 1:26-cv-04929 and others — CourtListener docket for No. 1:26-cv-04929• Class action complaint, No. 1:26-cv-04929, ECF No. 1 (filed October 2, 2026) — PDF via CourtListener RECAP
• California Attorney General — Poppins Payroll Company breach notification listing
• Poppins Payroll sample breach notice letter, dated September 29, 2026 — PDF via the California Attorney General
For more class actions keep scrolling below.
Status
Lawsuits Filed · Complaint Stage · No Class Certified
Case Title
Poppins Payroll data breach suits, D. Colo. No. 1:26-cv-04929 and others
Case Number
1:26-cv-04929-RMR-CYC (first filed)
Court
U.S. District Court, District of Colorado
Judge
Chief Judge Regina M. Rodriguez
Date Filed
October 2, 2026
Related Cases
Nos. 1:26-cv-04980, 1:26-cv-04983 and 1:26-cv-04994, filed October 6, 2026
