Signed up for Klaviyo? Dozens of advertisers may have seen your password

{
  "signal_id": "f02851cc-d6a5-4739-647e-d7f9cb332579",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-08-10T14:14:43+00:00",
  "company": {
    "name": "Klaviyo",
    "domain": "klaviyo.com"
  },
  "data": {
    "url": "https://techcrunch.com/2026/08/10/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password/",
    "title": "Signed up for Klaviyo? Dozens of advertisers may have seen your password",
    "author": "Zack Whittaker",
    "excerpt": "Newly revealed security research found that until recently, marketing tech giant Klaviyo was inadvertently sharing the sign-up information of its new customers, including their passwords, with outside advertisers. Sam Jadali, a security researcher and co-founder of cybersecurity startup Melurna , told TechCrunch that the web form on Klaviyo’s sign-up page was misconfigured between at least February 2024 through November 2025, though likely longer. The startup’s tests found that anyone who signed up to Klaviyo using the misconfigured form may have had their sign-up information shared with any of the third-party tech giants and advertisers whose trackers are also embedded on the company’s website. This sign-up data included the customer’s email address and password, as well as their company’s name, website address, and phone number. This information was shared with advertising and tech giants including Facebook and Google; marketing giant HubSpot; Microsoft and its subsidiary LinkedIn; social media site X, and others. The startup shared its findings with TechCrunch ahead of its talk at the Def Con security conference in Las Vegas. Klaviyo confirmed to TechCrunch that it fixed the website bug, but questions linger about the incident, including how many people were affected by the data leak over the years. The Boston-based marketing giant allows its 205,000 paying customers to...",
    "summary": "Marketing technology company Klaviyo inadvertently shared new customer sign-up information, including passwords, with outside advertisers due to a misconfigured web form active from at least February 2024 through November 2025.",
    "location": "Boston, Massachusetts, USA",
    "planning": false,
    "image_url": "https://techcrunch.com/wp-content/uploads/2026/08/klaviyo-2283003642.jpg?resize=1200,800",
    "confidence": 1,
    "published_at": "2026-08-10T14:14:43Z",
    "location_data": [
      {
        "city": "Boston",
        "state": "Massachusetts",
        "region": "Northern America",
        "country": "United States",
        "continent": "Americas",
        "fuzzy_match": false
      }
    ],
    "vulnerability": "Misconfigured sign-up web form shared customer email addresses, passwords, company names, websites, and phone numbers with third-party advertisers.",
    "article_sentence": "Newly revealed security research found that until recently, marketing tech giant Klaviyo was inadvertently sharing the sign-up information of its new customers, including their passwords, with outside advertisers."
  }
}

curl https://signals.autobound.ai/v1/signals/f02851cc-d6a5-4739-647e-d7f9cb332579 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"klaviyo.com","limit":20}'