Klaviyo sign-up form leaked customer passwords to major ad platforms for 21 months

A misconfigured Klaviyo sign-up form exposed new customers' email addresses, passwords, phone numbers, and company details to advertising platforms including Facebook, Google, Microsoft, LinkedIn, and X for at least 21 months, per researcher Sam Jadali. Klaviyo, which has 205,000 paying customers, confirmed it fixed the bug but has not publicly disclosed the incident. The affected-count figure of under 200 relies on "readily available active logs."