Signed up for Klaviyo? Dozens of advertisers may have seen your password

Security researchers found that a misconfigured signup form on marketing platform Klaviyo leaked new customers' sign-up information — including email addresses, plaintext passwords, company name, website and phone number — to embedded third-party trackers (Facebook, Google, HubSpot, Microsoft/LinkedIn, X, etc.). Klaviyo fixed the configuration issue after being notified and said fewer than 200 individuals were known to be affected based on active logs, but the company did not disclose how far back logs go or the full scope of the exposure.