Privacy Unpacked
Menu

Incident · one vendor, 2 organisations

The Klaviyo breach

26 May 2026 to 9 November 2026

2 organisations on the tracker had data taken through Klaviyo. Each one is listed with the words of the source that names Klaviyo.

KlaviyoNickey KehoeNickey KehoeWho Gives A CrapWho Gives A Crap KlaviyoNickey KehoeWho Gives A Crap
Klaviyo in the middle; around it, the 2 organisations that had data taken through it. Each one links to its page.

Organisations affected through Klaviyo

  1. Nickey KehoeUSUnited States · 26 May 2026 –not reported
    unauthorized email sent through our email service provider, Klaviyo, as well as an export event that included receipt of the customer information stored in Klaviyo's system notice letter
  2. Who Gives A CrapAUAustralia · 9 November 2026 Email addressesPhone numbersNames+2 –not reported
    A case study confirms that WGAC has a close relationship with marketing provider Klaviyo Information Age

Counts are each organisation’s own and can overlap: one person can be a customer of several. An organisation joins this list only when a source names Klaviyo as the way its data was taken.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.