Loading story…
Klaviyo said a misconfigured account-registration form on its own website exposed some new customer sign-up data, including passwords, to embedded third-party advertising trackers. The browser-side leakage reportedly affected users registering from at least February 2024 through November 2025 and may have shared email addresses, passwords, company names, website addresses, and phone numbers, according to reporting and statements cited by TechRepublic and SC Media.
The issue was discovered by Melurna co-founder Sam Jadali, and Klaviyo said it has fixed the bug and notified identified affected users. The company said fewer than 200 people were confirmed impacted based on available logs, but the total scope remains unclear because Klaviyo has not disclosed its log-retention period or the full duration of exposure; the incident did not involve a compromise of Klaviyo’s customer database, but it raises account-takeover risk for affected users, particularly where passwords were reused or MFA was not enabled.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting says the browser-side exposure on Klaviyo's sign-up page persisted through at least November 2025, with trackers such as Meta, Google, HubSpot, Microsoft, LinkedIn, and X potentially able to access submitted registration data. The full duration remains unclear because Klaviyo did not disclose complete log-retention details or a full incident timeline.
Security researcher Sam Jadali found Klaviyo's own account-registration form was misconfigured from at least February 2024, allowing embedded third-party trackers to potentially receive sensitive sign-up data including email addresses, passwords, company names, website addresses, and phone numbers.
Klaviyo said it fixed the website configuration bug on its own sign-up page and attributed the issue to an application configuration problem. The company also said it notified the affected people it could identify and that fewer than 200 individuals are known to have been impacted based on available logs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ClickUp left a hardcoded third-party API key in a publicly accessible JavaScript file on its homepage, exposing **959 email addresses** and **3,165 internal feature flags** through unauthenticated requests. Reports said the issue was disclosed through HackerOne on January 17, 2025, yet the key allegedly remained active and unrotated into late April 2026. The exposed email addresses reportedly belonged to staff at major enterprises including Fortinet, Home Depot, Autodesk, Tenable, Rakuten, Mayo Clinic, Permira, and Akin Gump, as well as government personnel in multiple U.S. states, Queensland, and New Zealand. Researchers said no credentials, bypass, or advanced tooling were needed to retrieve the data because the key was embedded in client-side code loaded before authentication. In addition to personal contact information, the leaked feature flags revealed internal product testing, beta features, A/B experiments, and possible roadmap details, creating risks that include targeted phishing, social engineering, credential-stuffing attempts, competitive intelligence collection, and potential platform abuse. ClickUp had not publicly acknowledged the exposure at the time of reporting.
Jun 29, 2026
Mailchimp disclosed that attackers used social engineering against employees and contractors to steal credentials and access an internal customer support and account administration tool, leading to unauthorized access to **133 customer accounts**. The company said it detected the activity on January 11, suspended affected accounts, and notified impacted customers within 24 hours. Mailchimp added that **passwords and payment card data were not exposed**, but the compromised account information could still be used for targeted phishing and other follow-on attacks. The incident echoed an earlier Mailchimp breach in which intruders again manipulated employees to gain access to internal tools and target customers in the **cryptocurrency and finance** sectors. In that earlier case, attackers compromised **319 accounts**, exported audience data from **102 accounts**, accessed some customer API keys that were later disabled, and used the stolen data to send phishing emails, including messages aimed at **Trezor** users that impersonated breach notifications. The repeated intrusions highlighted the downstream risk posed by marketing platforms that hold customer contact data and administrative access across many organizations.
Jun 29, 2026
Attackers breached market intelligence vendor **Klue** and used a compromised legacy credential tied to an old integration service to implant malicious code, harvest customer OAuth tokens, and access connected **Salesforce** environments through the `Klue Battlecards` app. Incident responders and affected companies said the attackers then used legitimate Salesforce REST API access to enumerate objects and exfiltrate CRM data over many hours, including business contacts, account records, quotes, sales communications, support case metadata, and related commercial information. **Salesforce** disabled the Klue app connection during the investigation and stressed the incident did not result from a vulnerability in the Salesforce platform itself, while Klue revoked credentials and tokens, disabled multiple integrations, engaged CrowdStrike, and notified law enforcement. The campaign has been widely attributed to the **Icarus** extortion group, which allegedly sent ransom demands and threatened to leak stolen data, though some reporting noted tradecraft overlaps with **ShinyHunters**-style Salesforce OAuth abuse. Publicly disclosed victims grew from early reports involving **Huntress**, **Recorded Future**, **Jamf**, **Tanium**, **Sprout Social**, **Gong**, **HackerOne**, **Snyk**, **OneTrust**, and **Insurity** to later confirmations from **LastPass**, **BeyondTrust**, and others, with some reports putting the total affected customer count far higher. Most impacted organizations said the exposure was largely confined to CRM and business data in Salesforce or connected apps, with no evidence that core products, internal infrastructure, password vaults, payment data, or engineering systems were compromised.
Aug 11, 2026