Archive — US — techcrunch
Signed up for Klaviyo? Dozens of advertisers may have seen your password
Klaviyo recently faced a security issue where misconfigured sign-up forms inadvertently exposed new customers' sensitive data, including passwords, to third-party advertisers like Facebook and Google, from February 2024 to November 2025. The company has since fixed the issue but has not transparently disclosed how many users were affected.
Key points
- Klaviyo's sign-up page had a misconfiguration leading to the exposure of customer information.
- The leaked data included emails, passwords, company info, and was shared with major advertisers.
- The issue lasted from at least February 2024 to November 2025.
- Klaviyo confirmed fixing the bug but did not disclose the full extent of the breach.
- Fewer than 200 people were reportedly affected according to Klaviyo's logs.
- Similar past incidents with misconfigured trackers have led to regulatory scrutiny.
Why it matters
- This incident reflects broader IT trends regarding data privacy and security, as companies increasingly rely on third-party trackers.
- The event occurred amidst heightened awareness of cybersecurity threats and data breaches in 2025.
- Misconfigured tracking pixels have been an ongoing issue, highlighting the need for rigorous security practices in digital marketing.
Klaviyo's data leak underlines the critical importance of secure application configurations, particularly in the marketing technology sector where user data privacy is paramount. Failure to disclose such incidents can further erode consumer trust.