Klaviyo Sign-Up Data Leak Exposed Passwords to Advertisers
Security research reveals Klaviyo mistakenly shared new user data, including passwords, with third-party advertisers due to a misconfigured form.
1How the Vulnerability Was Discovered
Cybersecurity researcher Sam Jadali found that Klaviyo's sign-up form was misconfigured from February 2024 to November 2025. During this period, users' email addresses, passwords, and company details were leaked to ad giants like Facebook, Google, and HubSpot. Tests by Melurna confirmed that third-party trackers collected this sensitive data without proper safeguards.
2Scope of the Data Exposure
The leaked data included users' login credentials, company names, website URLs, and phone numbers. With 205,000 paying customers and 7 billion managed profiles, the potential impact is significant. However, Klaviyo claims only 200 individuals were affected based on available logs. The company hasn't disclosed how long logs are retained or the full duration of the vulnerability.
3Company's Response to the Incident
Klaviyo acknowledged the issue as an 'application configuration problem' in statements to TechCrunch. While the company says it notified affected users, it refused to share copies of these communications or explain why the incident wasn't publicly disclosed. Critical questions remain unanswered about log retention policies and the true timeline of the data exposure.
4Risks of Third-Party Trackers
Web trackers (pixels), commonly used for analytics, can inadvertently expose personal data when misconfigured. Recent years have seen multiple cases where pixel-related leaks triggered regulatory actions. Klaviyo's incident highlights ongoing security gaps in ad tech infrastructure, particularly around sensitive data handling by marketing platforms with embedded third-party code.
5Implications for Affected Users
Password exposure creates credential stuffing risks across other services if users recycle passwords. While password managers and unique credentials mitigate this, Klaviyo hasn't clarified whether it recommended password changes to all potentially affected users. The lack of transparency about notification content raises concerns about adequate user guidance following the breach.
6Broader Industry Context
Klaviyo joins a growing list of companies caught unintentionally sharing data via trackers. In 2023, a healthcare provider faced a $1.8M penalty after leaking patient data to Facebook via pixels. These recurring incidents underscore systemic issues in ad tech's data governance, where convenience often outweighs security considerations during third-party integrations.
7Protective Measures for Users
Security experts recommend ad blockers to limit tracker data collection, alongside using unique passwords and enabling two-factor authentication. For Klaviyo users, immediate password changes are advisable. The incident serves as a reminder that even reputable marketing platforms can become data leakage vectors when proper security reviews aren't conducted on third-party components.
8Key Takeaways for Data Security
This breach underscores the need for regular audits of third-party integrations, especially in marketing tech stacks handling sensitive data. Despite GDPR and CCPA regulations, preventable leaks persist due to configuration errors. Transparent disclosure practices and robust log retention policies remain critical gaps—Klaviyo's reluctance to share details about log duration exemplifies this systemic challenge in breach accountability.