\n<\/p>\n
Newly revealed security research found that until recently, marketing tech giant Klaviyo<\/a> was inadvertently sharing the sign-up information of its new customers, including their passwords, with outside advertisers.<\/p>\n Sam Jadali, a security researcher and co-founder of cybersecurity startup Melurna<\/a>, told TechCrunch that the web form on Klaviyo\u2019s sign-up page was misconfigured between at least February 2024 through November 2025, though likely longer.<\/p>\n The startup\u2019s tests found that anyone who signed up to Klaviyo using the misconfigured form may have had their sign-up information shared with any of the third-party tech giants and advertisers whose trackers are also embedded on the company\u2019s website.<\/p>\n This sign-up data included the customer\u2019s email address and password, as well as their company\u2019s name, website address, and phone number. This information was shared with advertising and tech giants including Facebook and Google; marketing giant HubSpot; Microsoft and its subsidiary LinkedIn; social media site X; and others.<\/p>\n The startup shared its findings with TechCrunch ahead of its talk at the Def Con security conference in Las Vegas.<\/p>\n Klaviyo confirmed to TechCrunch that it fixed the website bug, but questions linger about the incident, including how many people were affected by the data leak over the years. The Boston-based marketing giant<\/a> allows its 205,000 paying customers to send advertising campaigns across email, text messages, and other channels. Klaviyo\u2019s website says it manages over seven billion customer profiles.<\/p>\n The bug underscores the data risks that third-party trackers can pose to website users when not using defensive tools, like ad-blockers<\/a>. Klaviyo is the latest company in recent years to have been caught out by inadvertently sharing data with outsiders.<\/p>\n Website trackers, known as \u201cpixels,\u201d allow website and app owners to collect information about their visitors and users, often for understanding how their apps are used and for identifying bugs. These trackers can be misconfigured to also share personal information entered into any web page that they are on.\u00a0<\/p>\n In the past few years, security lapses stemming from misconfigured pixel trackers have resulted in companies filing data breach disclosures<\/a> and regulators taking enforcement action<\/a>.<\/p>\n When reached by TechCrunch, Klaviyo spokesperson Danielle Zanatta confirmed that the bug was related to an \u201capplication configuration issue.\u201d Zanatta said the number of known individuals affected was fewer than 200 people, \u201cbased on our readily available active logs.\u201d Klaviyo would not say how far back it stores logs, or for how long the bug was active on its website.<\/p>\n Klaviyo said it notified the known individuals affected, but would not provide a copy of the communication that the company allegedly shared with affected customers when asked by TechCrunch.\u00a0<\/p>\n It\u2019s unclear why the company did not publicly disclose the incident.\u00a0<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n