Massive Data Leak Exposed at Klaviyo: Thousands of Users' Passwords Shared with Advertisers

Klaviyo, a marketing tech giant, has been inadvertently sharing the sign-up information of its new customers, including their passwords, with outside advertisers.

Security researcher Sam Jadali, co-founder of cybersecurity startup Melurna, discovered the issue after testing Klaviyo's sign-up process. He found that the web form on Klaviyo's sign-up page was misconfigured between at least February 2024 and November 2025, potentially exposing thousands of users' sensitive information.

The misconfigured form shared users' email addresses and passwords, as well as their company's name, website address, and phone number, with any third-party tech giants and advertisers whose trackers were embedded on the company's website. This included Facebook, Google, HubSpot, Microsoft, LinkedIn, X, and others.

Klaviyo confirmed to TechCrunch that it fixed the website bug, but questions remain about the incident, including how many people were affected by the data leak over the years. The company's website says it manages over seven billion customer profiles, and its 205,000 paying customers can send advertising campaigns across email, text messages, and other channels.

The bug underscores the data risks that third-party trackers can pose to website users when not using defensive tools, like ad-blockers. Klaviyo is the latest company in recent years to have been caught out by inadvertently sharing data with outsiders.

Website trackers, known as "pixels," allow website and app owners to collect information about their visitors and users, often for understanding how their apps are used and for identifying bugs. However, these trackers can be misconfigured to also share personal information entered into any web page that they are on.

In the past few years, security lapses stemming from misconfigured pixel trackers have resulted in companies filing data breach disclosures and regulators taking enforcement action.

When reached by TechCrunch, Klaviyo spokesperson Danielle Zanatta confirmed that the bug was related to an "application configuration issue," but the company refused to provide further details, including how far back it stores logs or for how long the bug was active on its website.

Klaviyo said it notified the known individuals affected, but would not provide a copy of the communication that the company allegedly shared with affected customers when asked by TechCrunch.

It's unclear why the company did not publicly disclose the incident.

The incident highlights the need for companies to prioritize data security and transparency in the face of growing concerns about online privacy.

• Klaviyo's misconfigured website form shared new customers' sign-up information, including passwords, with outside advertisers.
• The incident has raised questions about the number of people affected and the company's decision not to publicly disclose the issue.
• The bug underscores the data risks that third-party trackers can pose to website users when not using defensive tools, like ad-blockers.
• **Klaviyo's handling of the incident has sparked concerns about the company's commitment to data security and transparency.