A vulnerability in marketing automation platform Klaviyo allowed dozens of advertisers to access customer passwords. The bug has since been patched.
Klaviyo, a widely-used marketing automation service, disclosed a security flaw that exposed user credentials to third-party advertisers on its platform.
The bug occurred on Klaviyo's website and allowed advertisers with access to the platform to view passwords belonging to signed-up users. The exact number of affected accounts remains unclear, though the company confirmed dozens of advertisers were potentially exposed to the sensitive data.
Klaviyo has since fixed the vulnerability and is investigating the scope of the breach. The incident highlights persistent security challenges in SaaS platforms that handle customer authentication data.
Users who signed up for Klaviyo during the vulnerability period should consider changing their passwords, particularly if they reuse credentials across multiple services. Klaviyo has not announced mandatory password resets but recommends users review their account security settings.
The company has not disclosed when the bug was first introduced or how long it remained active before discovery.
Simply deleting files from old USB drives before disposal provides minimal data protection. Experts warn that deleted data can be recovered with basic tools, making proper wiping essential.
CISA has confirmed that ransomware groups are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 devices, including a critical server-side request forgery flaw.
A security researcher purchased the domain noreply.net and began receiving confidential company data sent by automated systems. The incident reveals how businesses misuse no-reply email addresses, treating them as digital trash cans without understanding the security risks.
AI-powered attacks are rendering traditional security credentials obsolete. Organizations are now integrating device trust into Zero Trust frameworks to counter increasingly sophisticated phishing, credential theft, and social engineering.