Marketing technology company Klaviyo inadvertently shared some new customers’ sign-up information, including passwords, with third-party advertising and technology companies because of a configuration error on its website. Security researcher Sam Jadali, co-founder of cybersecurity startup Melurna, said the affected sign-up form was misconfigured from at least February 2024 through November 2025, and possibly for longer. According to the research, third-party trackers embedded on Klaviyo’s website could receive the information when customers submitted the form. Trackers Could Receive Sign-Up DetailsThe companies whose tracking technology could receive the data included Google, Facebook, HubSpot, Microsoft, LinkedIn and X, among others. Jadali said the Klaviyo case illustrates how personal information can be exposed through ordinary analytics infrastructure without a conventional intrusion.