--- title: Signed up for Klaviyo? Dozens of advertisers may have... description: A security researcher discovered that Klaviyo's sign-up page was misconfigured for at least 21 months, inadvertently leaking new customers' sign-up data —... canonical: https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Signed up for Klaviyo? Dozens of advertisers may have seen your password | daily.dev og:description: A security researcher discovered that Klaviyo's sign-up page was misconfigured for at least 21 months, inadvertently leaking new customers' sign-up data —... og:url: https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk og:image: https://api.daily.dev/og/posts/Qowqzboyk.png og:image:alt: Signed up for Klaviyo? Dozens of advertisers may have seen your password og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Signed up for Klaviyo? Dozens of advertisers may have seen your password **[TechCrunch](https://daily.dev/sources/tc)** · 3 min read · 0 upvotes · 0 comments ## Summary A security researcher discovered that Klaviyo's sign-up page was misconfigured for at least 21 months, inadvertently leaking new customers' sign-up data — including email addresses and plaintext passwords — to third-party advertisers via embedded pixel trackers. Recipients included Facebook, Google, HubSpot, Microsoft, LinkedIn, and X. Klaviyo confirmed fixing the bug and claims fewer than 200 known individuals were affected based on available logs, but declined to disclose how long logs are retained or publicly announce the incident. The case highlights the broader risk of misconfigured third-party tracking pixels on web forms handling sensitive data. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What data was exposed in the Klaviyo pixel tracker misconfiguration bug? The Klaviyo sign-up form was misconfigured between at least February 2024 and November 2025, leaking new customers' email addresses, passwords, company names, website addresses, and phone numbers to embedded third-party trackers. Recipients included Facebook, Google, HubSpot, Microsoft, LinkedIn, and X. Klaviyo claims fewer than 200 known individuals were affected based on available logs, but did not disclose how far back those logs extend. _Developers handling sign-up forms with third-party pixels track incidents like this on daily.dev to catch risks before they hit their own stack._ ### How can misconfigured pixel trackers on a sign-up page leak user passwords to advertisers? Pixel trackers embedded on a web page can capture any data entered into forms on that page if misconfigured. When a sign-up form submits data, the tracker fires and may include form field values — including passwords — in its request payload sent to the advertiser's servers. This is a known risk with analytics and ad pixels placed on pages that handle sensitive user input. _Teams auditing their own sign-up flows for tracker exposure find relevant security research on daily.dev._ ## Similar posts on daily.dev - [LastPass confirms data breach in Klue supply chain attack](https://daily.dev/posts/lastpass-confirms-data-breach-in-klue-supply-chain-attack-vv50ily4v) · BleepingComputer · 6 upvotes · 4 comments - [LastPass says hackers stole customer data through a supply chain breach at Klue](https://daily.dev/posts/lastpass-says-hackers-stole-customer-data-through-a-supply-chain-breach-at-klue-cot1tyrco) · The Next Web · 0 upvotes · 0 comments - [Password manager maker LastPass says hackers stole customer support case data during Klue breach](https://daily.dev/posts/password-manager-maker-lastpass-says-hackers-stole-customer-support-case-data-during-klue-breach-n8k7j6rbl) · TechCrunch · 0 upvotes · 0 comments - [Your sign-up form is a weapon](https://daily.dev/posts/your-sign-up-form-is-a-weapon-cwnsa8fnc) · Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Signed up for Klaviyo? Dozens of advertisers may have seen your password","url":"https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk"},"datePublished":"2026-08-10T14:18:20.076Z","dateModified":"2026-08-10T14:18:48.429Z","description":"A security researcher discovered that Klaviyo's sign-up page was misconfigured for at least 21 months, inadvertently leaking new customers' sign-up data —...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9b3a5fd238d6b8df971e4e21f9c2fecd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9b3a5fd238d6b8df971e4e21f9c2fecd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"TechCrunch","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"TechCrunch","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tc","url":"https://daily.dev/sources/tc"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"TechCrunch","item":"https://daily.dev/sources/tc"},{"@type":"ListItem","position":3,"name":"Signed up for Klaviyo? Dozens of advertisers may have seen your password"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/signed-up-for-klaviyo-dozens-of-advertisers-may-have-seen-your-password-qowqzboyk#faq","mainEntity":[{"@type":"Question","name":"What data was exposed in the Klaviyo pixel tracker misconfiguration bug?","acceptedAnswer":{"@type":"Answer","text":"The Klaviyo sign-up form was misconfigured between at least February 2024 and November 2025, leaking new customers' email addresses, passwords, company names, website addresses, and phone numbers to embedded third-party trackers. Recipients included Facebook, Google, HubSpot, Microsoft, LinkedIn, and X. Klaviyo claims fewer than 200 known individuals were affected based on available logs, but did not disclose how far back those logs extend. Developers handling sign-up forms with third-party pixels track incidents like this on daily.dev to catch risks before they hit their own stack."}},{"@type":"Question","name":"How can misconfigured pixel trackers on a sign-up page leak user passwords to advertisers?","acceptedAnswer":{"@type":"Answer","text":"Pixel trackers embedded on a web page can capture any data entered into forms on that page if misconfigured. When a sign-up form submits data, the tracker fires and may include form field values — including passwords — in its request payload sent to the advertiser's servers. This is a known risk with analytics and ad pixels placed on pages that handle sensitive user input. Teams auditing their own sign-up flows for tracker exposure find relevant security research on daily.dev."}}]} ```