Klaviyo Security Flaw Exposed Leaked User Passwords

Klaviyo, a major marketing technology company, was found to have accidentally shared new customers’ sensitive data, including passwords and email addresses, with third-party advertisers because of a configuration error in its signup form. According to a report published by TechCrunch, the flaw drew the attention of media outlets and experts, once again putting serious digital security issues in the spotlight. TechCrunch.com reports .

Sam Jadali, a researcher and co-founder of the cybersecurity startup Melurna, discovered that the signup form on Klaviyo’s website had been misconfigured for at least the period from February 2024 to November 2025, and possibly even longer. During this period, data from users who registered on the site was transmitted to various third-party trackers embedded on the website and major advertising platforms.

Data Leaked Through Trackers

Researchers say the security gap exposed not only users’ email addresses and passwords, but also valuable information such as company names, website addresses and phone numbers. According to ixbt.com and TechCrunch, this sensitive data reached major technology and marketing platforms including Facebook, Google, Microsoft and its subsidiary LinkedIn, as well as HubSpot and the social network X.

Based in Boston, marketing giant Klaviyo helps more than 205,000 paying customers manage advertising campaigns through email, text messages and other channels. According to information on the company’s official website, its system manages more than seven billion customer profiles. This scale shows how enormous the risk from a data breach could be.

Company’s Official Response and Security Measures

Representatives of the Melurna startup shared their findings with TechCrunch before presenting them at the Def Con security conference in Las Vegas. Klaviyo’s management subsequently confirmed that the website error had been fixed. However, questions remain unanswered about how many users were affected over the years and how long backup logs are retained.

Klaviyo spokesperson Danielle Zanatta told TechCrunch that the issue was caused by an “application configuration problem.” According to her, fewer than 200 affected individuals have been identified based on the active logs available. However, the company declined to disclose how long the logs are retained or when the error actually became active.

Experts note that the incident once again demonstrated the risks posed by third-party trackers known as “pixels” when protective tools such as ad blockers are not used. In recent years, many companies have been forced to report data breaches caused by improperly configured trackers, prompting serious action from regulators.