What is an account compromise?

An account compromise occurs when an unauthorized actor gains access to your user account. This could allow the attacker to view, steal, or alter sensitive information and possibly misuse your account for malicious purposes, such as sending phishing emails or exporting customer data.

How can you tell if your account has been compromised?

Signs your Klaviyo account may have been compromised include:

• Receiving password reset emails you didn’t request, or “login alert” emails that don’t seem right, such as New Device or Unrecognized Location emails.
• Noticing unfamiliar changes to your account settings or email templates.
• Seeing campaign, flow, list, segment, or profile activity you didn’t initiate.
• API calls from an unrecognized source or performing actions you don’t expect.
• Being unable to log in with your existing password (if it was changed by someone else).

What do you do if you suspect your Klaviyo account has been compromised?

• Immediately reset your password using a strong, unique passphrase.
  • Resetting your password ends sessions using your login. It does not remove other users from your Klaviyo account or revoke private API keys. Review those separately as described below.
• Enable or review multi-factor authentication (MFA) for your login under Settings > General > Security. Follow the MFA setup instructions to finish setting up a method.
• Delete suspicious or unfamiliar private API keys. If you cannot manage API keys, ask an Owner or Admin for help.
  • Deleting a private API key cannot be undone. Applications that use that key will need a new key to reconnect.

1. Go to Settings > General > API keys.
2. Open the menu next to the private API key you want to revoke and select Delete.
3. Click Delete in the confirmation dialog.

• Check recent activity (flows, campaigns, exports) for anything unauthorized.
• Review your account’s users and remove any unauthorized users. If you cannot manage users, ask an Owner or Admin for help.
• Report the incident to Klaviyo support at abuse@klaviyo.com and your internal IT/security team.

How to prevent account compromise

• Use strong, unique passwords or passphrases for your Klaviyo account. Never reuse passwords across sites.
  • Consider using a password manager. Many are free or inexpensive and can help you protect your data with minimal effort.
• Enable strong multi-factor authentication (MFA) to add an extra layer of security.
• Review and manage your account’s users and permissions regularly; remove old or unused users.
  • Ensure you’re never sharing login credentials between multiple people - you can have as many people as you want on your Klaviyo account for free. Shared user accounts make it impossible for you to tell who took an action in your account, and also make it harder for Klaviyo to detect if someone is accessing your account who shouldn’t.
• Review and manage your account’s private API keys and scopes regularly; rotate or delete old or unused keys, and keep them in a secure place rather than exposing them publicly.
• Be wary of phishing attempts; never enter your Klaviyo credentials after clicking a suspicious link.
• Monitor your account activity for any unusual logins or actions.
• Educate your team about security best practices and common social engineering tactics.