Klaviyo Security Bug May Have Exposed Customer Sign-Up Details to Advertisers

A security issue on Klaviyo’s website may have exposed sensitive information entered by people signing up for the marketing platform. 

The problem involved a website configuration that allowed third-party tracking tools to receive information submitted through the registration form.

Security researcher Sam Jadali and his cybersecurity company Melurna discovered the issue while investigating how website trackers handle user information. 

Their research indicated that the problem may have existed from at least February 2024 until November 2025, although the exact start date remains unclear.

What Information Was Potentially Shared?

The affected registration form could send more information than users would normally expect to advertising and technology companies whose tracking tools were present on the website.

The information reportedly included email addresses and passwords. 

Other details, such as a company’s name, website address, and phone number, could also have been transmitted.

The researchers identified trackers connected to several major technology and advertising companies, including Google, Facebook, Microsoft, LinkedIn, X, and HubSpot.

This does not mean every person who used Klaviyo during the affected period had their information accessed or viewed by those companies. 

However, the configuration created a possibility that sensitive sign-up information could be sent to third parties.

Klaviyo Says the Issue Has Been Fixed

Klaviyo confirmed that the problem was caused by an application configuration issue and said it has since been corrected.

The company said its available records indicate that fewer than 200 people are known to have been affected. 

Klaviyo also said it contacted the individuals it identified as being impacted.

However, questions remain about the full scope of the incident. 

The company did not say how long its relevant website logs are retained, making it difficult to determine whether older activity can be completely reviewed.

Why Website Trackers Can Create Privacy Risks

The incident also highlights a broader problem with website tracking technology.

Tracking pixels are commonly used by websites to understand visitor activity, measure advertising performance, and improve digital services. 

When configured correctly, they can serve useful purposes.

The risk appears when these tools receive information that users enter into forms. 

If a website does not properly control what information trackers can access, private details may unintentionally be transmitted outside the company.

Similar problems involving tracking pixels have previously resulted in investigations, data-breach disclosures, and regulatory action.

What Users Should Take Away

The Klaviyo incident is a reminder that information entered into an online form does not always remain limited to the company operating the website. 

Businesses need to carefully control third-party tracking tools, especially on pages where customers provide sensitive information.

Users should also avoid reusing passwords across different services. 

If a password may have been exposed, changing it promptly and enabling multi-factor authentication can reduce the potential impact.

Conclusion

The Klaviyo security bug shows how a seemingly small website configuration problem can create significant privacy risks. 

Although Klaviyo says it has fixed the issue and identified fewer than 200 affected people, the incident highlights the importance of protecting sensitive information from third-party trackers. 

Stronger privacy controls and careful website security practices remain essential as online tracking becomes more widespread.