Signed up for Klaviyo? Dozens of advertisers may have seen your password | TechCrunch

A security vulnerability on the registration page of marketing technology firm Klaviyo recently exposed the personal information of new registrants to external advertising networks and tech corporations.

Discovered by a cybersecurity researcher, the flaw stemmed from a misconfigured web form that automatically transmitted sensitive sign-up details to third-party trackers embedded on the site. Exposed data included user passwords, email addresses, corporate telephone numbers, and company names, which were forwarded to various major social media and advertising platforms operating these tracking pixels. The researcher noted that this leak was active for many months, potentially exposing anyone who utilized the flawed sign-up process during that timeframe.

Klaviyo confirmed it resolved the technical issue but has faced scrutiny regarding its transparency and the true scale of the leak. While the firm reported that its active records indicate fewer than 200 individuals were impacted, it declined to clarify the exact duration of the vulnerability or reveal how long its logs are retained. Additionally, the company has not publicly released the notifications sent to the affected users, leaving questions unanswered about the exact scale and historical duration of the exposure. Security experts emphasize that this incident underscores the systemic risks posed by third-party tracking tools, which can inadvertently harvest and transmit sensitive credentials if website operators fail to implement strict data privacy safeguards.