A Marketing Company's Sign-Up Form Was Leaking Passwords to Advertisers

A misconfigured sign-up form on Klaviyo's website exposed new customers' email addresses and passwords to third-party advertisers for at least 21 months, according to security researcher Sam Jadali, who detailed the findings ahead of a presentation at the Def Con security conference in Las Vegas. (TechCrunch)

Jadali, co-founder of cybersecurity startup Melurna, shared his research with TechCrunch on August 10, 2026. The problem involved a common type of tracking tool called a "pixel" — a small piece of code that websites place on their pages to measure visitor activity, usually provided by advertising platforms like Facebook or Google. When a pixel is not set up correctly, it can accidentally capture and send along information that users type into forms on that page. In this case, the Klaviyo sign-up form was leaking the full contents of new customer registrations to advertising platforms.

The exposed data included email addresses, passwords, company names, website addresses, and phone numbers. That information was shared with Facebook, Google, HubSpot, Microsoft and its subsidiary LinkedIn, and X.

Klaviyo, a Boston-based marketing company, says it has 205,000 paying customers and manages over seven billion customer profiles, according to its website. The company confirmed to TechCrunch that it fixed the website bug responsible for the exposure. Spokesperson Danielle Zanatta described the issue as an "application configuration issue" and said that fewer than 200 known individuals were affected, based on readily available active logs. (TechCrunch)

Klaviyo said it notified the known affected individuals but would not provide a copy of the communication it allegedly shared with them. The company did not publicly disclose the incident, and it is unclear why.

The misconfiguration persisted between at least February 2024 and November 2025. The gap between the apparent fix date and the public disclosure in August 2026 raises questions about Klaviyo's transparency obligations, though the company has not publicly explained the delay.

This type of data leakage is not a new problem. Tracking pixels from major ad platforms can be embedded on any web page and, when set up incorrectly, will transmit the contents of form fields to the pixel operator's servers. The mechanics are straightforward: a pixel script that listens for form submissions and forwards whatever the user typed to an advertising company's servers. The failure is typically a setup mistake in how the pixel is connected to the page's form elements, not a flaw in the pixel technology itself.

What makes this incident notable is the sensitivity of the exposed data. Email addresses and phone numbers being captured by advertising pixels is a known and recurring problem. Passwords being transmitted alongside that data is a more serious failure. Think of it like a mailroom that was supposed to forward only marketing brochures but accidentally included sealed envelopes containing account credentials. Passwords entered into a sign-up form should never be present in data that an advertising pixel can read, which points to a form design that did not separate credential fields from tracking scripts, or a pixel setup that was not configured to exclude sensitive inputs.

Klaviyo's statement that fewer than 200 individuals were affected is drawn from "readily available active logs," which leaves open the question of whether older or less readily accessible log data might reveal a larger exposure window. The confirmed timeframe of at least February 2024 to November 2025 spans 21 months, and a sign-up form on a platform with 205,000 paying customers would typically receive substantial traffic over that period. The 200-affected figure may reflect the limits of available logging rather than the full scope of the exposure.

The distribution of exposed data to six major advertising platforms also complicates any remediation. Once password and email combinations reach an advertiser's systems, Klaviyo has no way to recall or delete that data. Affected individuals face potential credential exposure that persists indefinitely on systems outside Klaviyo's control.

For affected users, the practical guidance is direct: change the password used for the Klaviyo account, and if that password was reused elsewhere, change those too. This is standard advice, but it bears repeating given that Klaviyo has not disclosed how many users were actually notified or what specific information was communicated to them.

The broader context here is that pixel misconfiguration incidents have appeared with regularity across the industry, and the pattern is consistent: a form on a high-traffic page, a pixel setup that captures too much, and a gap of months or years before anyone notices. Each incident is treated as isolated, but the recurrence suggests a systemic gap in how organizations audit their tracking tools for data leakage. Organizations that place third-party advertising pixels on pages containing form fields should treat those integrations as potential data-exposure channels and test them accordingly.