Klaviyo Bug Leaked User Passwords to Facebook, Google — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Klaviyo's sign-up web form was misconfigured from at least February 2024 through November 2025, inadvertently transmitting new customers' email addresses, passwords, company names, websites, and phone numbers to third-party trackers embedded on the company's website.
- Sam Jadali, co-founder of cybersecurity startup Melurna, discovered the bug and shared his findings with TechCrunch ahead of his talk at the Def Con security conference in Las Vegas; the leaked data flowed to advertising and tech companies including Facebook, Google, HubSpot, Microsoft, LinkedIn, and X.
- Klaviyo spokesperson Danielle Zanatta confirmed the issue stemmed from an "application configuration issue" and said the number of known affected individuals was fewer than 200, based on "readily available active logs" — though the company declined to disclose how far back it stores logs or the total duration of the bug.
- Klaviyo said it notified the known affected individuals but would not share a copy of that communication with TechCrunch, and did not publicly disclose the incident.
- Klaviyo, a Boston-based marketing company with 205,000 paying customers that manages more than seven billion customer profiles, fixed the bug after being contacted.
- Misconfigured pixel trackers have triggered data breach disclosures and regulatory enforcement in recent years, and the Klaviyo case underscores the data risks third-party trackers pose to website visitors who don't use ad-blockers or similar defensive tools.
Why it matters: Klaviyo's silence on total exposure and its reliance on logs it admits are incomplete leaves affected users unable to know if their credentials reached dozens of ad-tech firms — and since some of those same firms (Meta, Google) also own authentication and identity products, a leak of plaintext passwords from a marketing platform could quietly seed credential-stuffing risks across a much wider consumer surface.
Ask SkimNews
