Klaviyo sign-up form leaked customer passwords to ad platforms for 21 months

A misconfigured Klaviyo sign-up form exposed new customers' emails, passwords, phone numbers, and company details to Facebook, Google, Microsoft, LinkedIn, and X for at least 21 months, per researcher Sam Jadali. Klaviyo, serving 205,000 paying customers, fixed the bug but hasn't publicly disclosed it. Its claim of under 200 affected users relies on "readily available active logs."