Klaviyo leaked new customers' passwords to advertisers for nearly two years

Marketing platform Klaviyo has been inadvertently sharing registration data of new users, including passwords, with third-party advertising systems for an extended period. Security researchers uncovered a critical misconfiguration in the web form on the company's website.

Sam Jadali, co-founder of cybersecurity startup Melurna, told TechCrunch that the issue existed from at least February 2024 through November 2025, and possibly longer. Testing revealed that anyone who created an account through the improperly configured form could have their data transmitted to trackers embedded on the page.

The leak involved the customer's email address, password, company name, website URL, and phone number. This information reached major players such as Facebook, Google, HubSpot, Microsoft, LinkedIn, and X. The researchers presented their findings at the Def Con security conference in Las Vegas, after sharing them with the publication in advance.

Klaviyo confirmed it fixed the bug, describing it as an "application configuration issue." However, the exact number of affected users remains unknown. Company spokesperson Danielle Zanatta said the confirmed count of impacted individuals is fewer than two thousand, but the scope of the incident over several years could be larger.

The Boston-based platform serves 205,000 paying customers and manages over seven billion user profiles. The incident highlights the risks posed by third-party trackers, known as "pixels," particularly for those who do not use ad blockers.

Such scripts are typically used to analyze visitor behavior and identify bugs, but when misconfigured, they can transmit personal data entered on any page. In recent years, similar leaks caused by faulty pixels have already led to official breach disclosures and regulatory enforcement actions.