What happened
On 10 September 2026 Thankyou Payroll notified customers that it had been caught up in a wider data security incident and apologised [nz-herald], [rnz-news]. Reports suggest the cause was a vulnerability in Metabase, an open-source business-intelligence platform [nz-herald]. B2B News reported that patching of the platform “did not happen in time” [b2b-typ]. The company said it notified the Office of the Privacy Commissioner [nz-herald].
Separately, Metabase published an advisory and patch on 6 August 2026 for CVE-2026-72898, a pre-authentication SQL injection flaw rated CVSS 10.0; exploitation of the flaw was observed from around 3 August 2026 [horizon3-metabase]. Media linked the Thankyou Payroll incident to the Metabase flaw; no source seen names the specific CVE in connection with Thankyou Payroll.
Data exposed
B2B News reported that IRD numbers, home addresses and bank details were exposed [b2b-typ]. Passwords and credit card numbers were reported as not compromised [nz-herald]. The number of people affected has not been disclosed and is not estimated here.
Timeline
- 2026-08-06 — Metabase publishes a security advisory and patch for CVE-2026-72898 [horizon3-metabase].
- 2026-08 — Data accessed (exact date not published); reports link the incident to the Metabase flaw [nz-herald], [b2b-typ].
- 2026-09-10 — Thankyou Payroll notifies customers and apologises; it says the Privacy Commissioner was notified [nz-herald], [rnz-news].
Current status
Disclosed. Thankyou Payroll says it notified the Office of the Privacy Commissioner [nz-herald]. Under New Zealand’s Privacy Act 2020, notifiable privacy breaches must be reported to the Commissioner as soon as practicable. No Privacy Commissioner statement, investigation or finding about this incident has been published.
Why it matters
The incident shows how a flaw in a widely used third-party tool can expose sensitive data at many organisations at once. An analyst quoted in the reporting said there were thousands of potential targets [nz-herald], and several other companies disclosed related Metabase incidents [expertinsights-metabase]. For payroll and HR systems, the data at risk — tax numbers and bank details — is highly sensitive.