Newly revealed security research found that until recently, marketing tech giant Klaviyo was inadvertently sharing the sign-up information of its new customers, including their passwords, with outside advertisers.

Sam Jadali, a security researcher and co-founder of cybersecurity startup Melurna, told TechCrunch that the web form on Klaviyo’s sign-up page was misconfigured between at least February 2024 through November 2025, though likely longer.

The startup’s tests found that anyone who signed up to Klaviyo using the misconfigured form may have had their sign-up information shared with any of the third-party tech giants and advertisers whose trackers are also embedded on the company’s website.

This sign-up data included the customer’s email address and password, as well as their company’s name, website address, and phone number. This information was shared with advertising and tech giants including Facebook and Google; marketing giant HubSpot; Microsoft and its subsidiary LinkedIn; social media site X, and others.

The startup shared its findings with TechCrunch ahead of its talk at the Def Con security conference in Las Vegas.

Klaviyo confirmed to TechCrunch that it fixed the website bug, but questions linger about the incident, including how many people were affected by the data leak over the years. The Boston-based marketing giant allows its 205,000 paying customers to send advertising campaigns across email, text messages, and other channels. Klaviyo’s website says it manages over seven billion customer profiles.

The bug underscores the data risks that third-party trackers can pose to website users when not using defensive tools, like ad-blockers. Klaviyo is the latest company in recent years to have been caught out by inadvertently sharing data with outsiders.

Website trackers, known as “pixels,” allow website and app owners to collect information about their visitors and users, often for understanding how their apps are used and for identifying bugs. These trackers can be misconfigured to also share personal information entered into any web page that they are on. 

In the past few years, security lapses stemming from misconfigured pixel trackers have resulted in companies filing data breach disclosures and regulators taking enforcement action.

When reached by TechCrunch, Klaviyo spokesperson Danielle Zanatta confirmed that the bug was related to an “application configuration issue.” Zanatta said the number of known individuals affected was fewer than 200 people, “based on our readily available active logs.” Klaviyo would not say how far back it stores logs, or for how long the bug was active on its website.

Klaviyo said it notified the known individuals affected, but would not provide a copy of the communication that the company allegedly shared with affected customers when asked by TechCrunch. 

It’s unclear why the company did not publicly disclose the incident. 

Ceva Logistics, one of the world’s largest shipping and logistics giants, has been hacked. Several companies that rely on Ceva for shipping their products to their customers say that their personal information was also stolen in the breach.

The cyberattack on Ceva is affecting at least eight warehouses across Europe used for shipping goods across the continent, the company told TechCrunch.

Industry news site FreightWaves reports that the hack began on July 29 and is causing shipping delays for many of the goods in affected warehouses.

Ceva is a France-headquartered shipping and logistics giant that companies around the world rely on to deliver their goods from their assembly lines to customer homes. The company, which brought in $18.3 billion in revenue in 2025, has over a thousand warehouses across the world.

Shipping and logistics giants have become a growing target for cybercriminals in recent years for their ability to access and hijack trucks and containers full of goods into the hands of real-world gangs.

The hack at Ceva also resulted in a data breach, affecting a large amount of personal information belonging to retail customers that Ceva relies on for delivering goods to people’s home addresses. Several companies reported that hackers took their customers’ names, home addresses, phone numbers, and email addresses used to place their orders from Ceva’s systems.

Dutch online retail giant Bol said on its website that hackers gained access to systems of its warehousing partner, Ceva, and warned that their customers’ data may have been taken. Bol also said that it expects delays and some customer orders to be cancelled as a result of the incident.

De Bijenkorf, another Dutch luxury retailer, similarly confirmed order delays following the theft of its customers’ data, per local media. Football club Ajax, banking giant ING, and eyeglass maker Ace & Tate also reported that customers’ shipping information was affected. 

Video game giant Valve told customers that it learned on August 7 that data was taken from Ceva’s systems, and alerted customers who recently bought its Steam hardware that they had personal information taken in the incident. Valve said in its note to customers, posted to Reddit, that Ceva stores their shipping and delivery information for 90 days following their order.

Valve spokesperson Doug Lombardi did not respond to a request for comment about the incident. 

Ceva confirmed in a statement to TechCrunch that it was experiencing a cyberattack.

“On Aug. 1, CEVA Logistics confirmed to affected customers that a cyber intrusion was impacting part of its European contract logistics operations. As soon as the incident was identified, CEVA’s cybersecurity teams immediately activated its security protocols and launched a thorough investigation, which is still ongoing,” per the statement provided to TechCrunch. “The operational impact is limited to eight warehouses. No other CEVA systems globally were affected, and all other operations continue without incident.”

Ceva spokesperson Ryan Fisher would not answer TechCrunch’s questions about the incident, such as if the company knows how much personal data was taken, or if Ceva has received any communication from the hackers, such as a ransom demand.

Ceva said some of its affected applications and services are back online, and that it was working with the authorities. Ceva’s website was not properly loading at the time of publication on Monday.

Authorities in the Netherlands are said to be investigating the incident. 

Mark Schenkel, a spokesperson for the Dutch data protection authority, did not respond to TechCrunch’s request for comment on Monday about the incident.

I’ve spent a fair bit of time being rude about how Google has handled Nest, with the company that kickstarted smart thermostats seeing a sad decline. Credit where credit’s due, Google has been extremely helpful dealing with a broken thermostat.

I use a Nest Thermostat 3rd Gen in a house we rent out because the hardware is robust, the device is mains-powered (so it can’t run out of battery), and it lets me turn the heating on and off depending on whether people are in the house.

Getting down to the house a week ago, I walked past the thermostat, only for it to light up and say that it can’t connect to the Heat Link. No problem, I thought; it had done this before, usually when a guest had turned the boiler off by mistake. 

I checked, and the power to the boiler was on. So, I checked the Nest Heat Link (the device that actually controls the boiler), and it was dead, with no lights. I pressed the button in the middle, but nothing. I turned the boiler off and back on again, and nothing.

As the Nest Thermostat was installed back in 2019, I was resigned to the fact that I’d have to try and buy a new Heat Link online, but while searching, I came across this page on the BOXT website, offering free Heat Link replacements, provided you’d been through Google support.

Support was quick to get, and the fix free

Next, I went to the Google Home and Nest Help site, and filled in my product details, including the product’s serial number, and the problem I was having. I then had a choice of either using an online chat or having Google call me when a support person was free. 

I picked the latter, and a minute later my phone rang. Within five minutes, I’d explained the issue, and it was agreed that there was a fault and that Google would authorise the repair.

A few seconds later, I had an email with a link to the BOXT website, with my support number pre-filled out. Then, I just had to pick a date for an engineer to come out (Friday 7 August), and that was it.

But shortly afterward, his Patreon account was taken down too. In an email statement, a spokesperson for the platform said: “Patreon prohibits works that provide instructions around the creation of controlled substances or other recreational drugs. We take violations of our policies seriously, and after an internal investigation, we have removed the creator’s account.”

Myco hopes to successfully appeal the Patreon decision, as he pays his team through the funds accrued from his subscribers. “I know I’m a renegade, but I don’t promote the use [of drugs],” he says. “It’s all scientific. It’s all education, in the hopes to promote harm reduction.”

As hallucinogens edge closer to mainstream medicine, Myco is pushing in the opposite direction—away from clinics, regulators, and expensive trip-sitters, and toward radical self-sufficiency. To his many supporters, the outlaw chemist is democratizing psychedelic knowledge, out of the hands of academics, dealers, and erstwhile gatekeepers. To critics, his confidence occasionally outruns his science, and his commitment to secrecy raises questions about at least some of what he says.

Myco, a 38-year-old from Boston who now lives in his parents’ native Puerto Rico, seems at ease breaking the law.

He claims that, in 2002, he produced his own DMT by following a published scientific extraction method. Smoking the resultant hallucinogen was a transformative experience. Psychedelics “became my entire world,” he says, adding that he was dealing with “a really serious depression” at the time, after his parents split and his uncle died. He says he communed with his late uncle in the throes of that DMT trip. “He reassured me that everything’s all right,” recalls Myco. From that point on, “I knew I wanted to be part of psychedelic history.”

After studying microbiology in college, Myco says, he started posting on drug forums like the Shroomery, Mycotopia, and Nexus in 2009 but was appalled by their cliquishness. “They treated new cultivators and chemists like shit,” he says. (A moderator from Shroomery says cliquish behavior does exist and can shut down people with new ideas, but they are glad it did not stop Myco “from pursuing his passion for chemistry and mycology.”)

Myco says he went on to work for a pharmaceutical company in Boston “making more money than I’d ever seen,” but it was only ever a stopgap. He says that in late 2014 he posted his first explainer video on YouTube on aspects of growing psilocybin mushrooms, while wearing a gas mask. Several months later Myco logged back into his YouTube creator account and discovered “it had completely blown up,” accruing thousands of subscribers. So he quit his job and created a Patreon—anointing his supporters as the “Trip Team family.”

In mid-2023 he started drawing up plans to brazenly educate people on how to produce LSD. “Sure, a chemist can go get a synthesis schematic and synthesize LSD, but for the average Joe it would look like hieroglyphics,” he says.

So he decided to try to become the first person to bring to the screen long-established LSD recipes shared by legendary psychedelic chemists Albert Hofmann and Sasha Shulgin. To minimize the threat of censure or even prosecution, Myco claims that in May 2024 he found a university laboratory in Pakistan, which apparently secured government approval to produce the psychedelics for scientific research.

Sunglasses were a simple product for most of their existence. Two lenses, a frame, UV protection. Then Meta put cameras in them, the smart glasses category took off, and a pair of shades became something a stranger could use to record you without your knowledge. DuckDuckGo, which has built its entire identity around the idea that your data shouldn’t be collected without consent, looked at that trend and responded with a product that refuses to participate in it: sunglasses with no camera, no microphone, no Bluetooth and no AI. They block sunlight. That’s the complete list of things they do.

Enter DuckDuckGo, the privacy-focused internet search engine and web browser company. The company has partnered with eyewear company Knockaround and is now selling what it calls “anti-surveillance” sunglasses, a simple yet chic style that’s just like the sunglasses we all knew before the AI surge. They protect your eyes and don’t spy on anyone.

Yes, you can buy analog sunglasses in a million other places, including your local drugstore. But DuckDuckGo is out to make a point: AI glasses don’t respect your privacy, and the best way to protest them is not to buy them. The DuckDuckGo sunglasses even have a sassy name: Normal F* ****** Sunglasses.

“We see the new wave of AI glasses as yet another privacy-invasive technology from Big Tech, so we created a satirical campaign around them and released Normal F****** Sunglasses,” a DuckDuckGo representative said. “Why? Because ultimately, the only truly privacy-respecting glasses are ones without cameras, mics, or AI listening in on you and others you come into contact with.”

Advertisement

The representative noted that DuckDuckGo CEO Gabriel Weinberg has publicly said that “AI surveillance should be banned while there is still time.”

The matte black sunglasses come in Knockaround’s Paso Robles frame design, look a lot like classic Ray-Ban Wayfarers with a small DuckDuckGo logo, and offer polarized lenses and UV400 protection. The playful website copy declares that they include zero cameras, guarantee zero notifications, offer a seamless offline mode and infinite charge life. They sell for $35 a pair.

Humor publication The Onion published a sly post about the DuckDuckGo sunglasses, sharing comical quotes from made-up consumers. “0/10, useless for perverts,” says one fictional person. Says another, “Guess I’ll have to violate people’s privacy the old-fashioned way: From the bushes.”

The representative told us that “a significant percentage of the inventory has sold, though it’s still too early to release sales data.”

Advertisement

CNET editor Gael Fashingbauer Cooper, a journalist and pop-culture junkie, is co-author of “Whatever Happened to Pudding Pops? The Lost Toys, Tastes and Trends of the ’70s and ’80s,” as well as “The Totally Sweet ’90s.” She’s been a journalist since 1989, working at Mpls.St.Paul Magazine, Twin Cities Sidewalk, the Minneapolis Star Tribune, and NBC News Digital. She’s Gen X in birthdate, word and deed. If Marathon candy bars ever come back, she’ll be first in line.

See full bio

SYSTEMS

The capital holds two-thirds of capacity, while multimegawatt projects gather beyond the M25

A snapshot of Britain’s datacenter estate puts nearly 40 percent of its facilities in London, along with about two-thirds of its estimated colocation capacity, although development is spreading beyond the capital.

The analysis counts 555 UK server farms, matching Statista’s latest figure. It puts their combined IT capacity at about 1.6 GW.

By facility count, that would put Blighty second only to the US, although there is a considerable gap between the two.

The study data was compiled by Karas Plating, a UK-based specialist in electroplating and surface coatings for critical electrical components and power distribution systems.

The firm presumably has an eye on where new business might emerge as new datacenters are planned as part of the government’s AI Opportunities Action Plan.

It will surprise nobody that London is the nexus of the UK’s data infrastructure, with clusters of bit barns to serve the financial markets in the City, and along the M4 motorway corridor close to the fiber-optic cable routes that stretch west from the capital to join the undersea cables linking with North America.

London has 219 active facilities, according to the analysis, or about 40 percent of the total. This adds up to 1,048 MW, or two-thirds of the country’s entire datacenter compute capacity. It also leads the way in future growth with 15 planned expansion projects.

But the report also indicates there is a significant shift taking place toward high-capacity regional infrastructure to support growing demand. This is something The Register has previously reported on, as developers look away from London due to issues like power shortages and planning constraints.

Outside the Big Smoke, South East England claims 62 current facilities, adding up to 128 MW capacity, with ten planned developments, the second-biggest expansion queue nationwide. We assume that these include bit barns close to London’s M25 orbital motorway, such as the massive campus planned by colocation firm Equinix at South Mimms.

Further afield, North West England has 39 active facilities with 52 MW capacity, and five upcoming builds. This makes it the region with the largest number of planned projects outside of the traditional hot spot of London and the South East.

The East of England and Scotland both have more operational datacenters, the first with 45 and a total of 44 MW capacity, while north of the border there are no fewer than 49 with a total of 30 MW.

Wales currently boasts 32 active sites, but these make for a total of 154 MW of IT capacity, coming in second only to London.

The region with the fewest current operational server farms is the South West, which has 20 sites adding up to 54 MW, and two new facilities planned. One of these is presumably the controversial Devon data campus near Great Torrington, which is claimed will house 1.5 GW of AI-optimized compute capacity.

Just ahead is North East England, where there are 21 sites with a total of 17 MW capacity. This will change in the near future, however, as US investment giant Blackstone has plans for a huge facility near Blyth, Northumberland, said to be large enough for 720 MW of IT.

OpenAI also aims to build a Stargate datacenter project at Cobalt Park, North Tyneside, although it has put these plans on hold for now, citing reasons such as the cost of energy in the UK. ®

Goldmund has introduced the Telos 9800, a new flagship mono power amplifier that delivers more than 1,500 watts and represents the most advanced amplifier the Swiss company has developed to date. With a $500,000 asking price, one might reasonably wonder whether it also includes a chalet in Gstaad, a numbered bank account, and someone to explain the purchase to your mistress in Geneva.

The Telos 9800 builds on the foundation of the Telos 8800, introduced in 2023, while incorporating new design and engineering developments that move it above both that model and the recently launched “midrange” Telos 4800. Goldmund does not replace its flagship amplifiers very often, so the Telos 9800 will likely remain at the top of the company’s lineup for several years.

Related Reading:

The Swiss Touch

Engineered and assembled in Switzerland, the Telos 9800 is built around an entirely new amplification platform. Its power supply and amplification stages are housed in separate but interconnected units, allowing each section to operate under optimal conditions while reinforcing the system’s overall mechanical and electrical integrity.

Designed with a symmetrical signal path from input to output, the Telos 9800 is intended to preserve signal integrity while minimizing electromagnetic interference and unwanted noise. It remains stable into loads as low as 1 ohm and incorporates comprehensive protection systems designed to maintain reliability under demanding operating conditions.

Developed in collaboration with designer Cécile Barani, the Telos 9800 introduces a new visual direction for Goldmund. Its two-part form mirrors the physical separation of the power supply and amplification stages, giving the amplifier a functional relationship between its internal architecture and exterior design. Precision-machined aluminum surfaces, a new digital interface, and a restrained gold accent complete a look that is notably more architectural than Goldmund’s previous flagship amplifiers.

Taken together, Goldmund says these design and engineering changes allow the Telos 9800 to deliver high output with greater control, particularly during demanding musical passages and large dynamic swings. The company also claims improvements in low-level detail, clarity, and overall precision, although those performance claims will ultimately depend on the associated system, loudspeakers, and listening environment.

What Makes the Goldmund Telos 9800 Different

Power Output: The Telos 9800 delivers 1,560 watts RMS into 8 ohms, with a specified total harmonic distortion (THD) of 0.005% from 20 Hz to 20 kHz.

Dynamic Range: Goldmund specifies a dynamic range of 117 dB, measured with a 22 kHz bandwidth, which is intended to preserve low-level detail across a wide range of listening levels.

Damping Factor: The Telos 9800 has a specified damping factor of 900 at 1 kHz and an output noise floor of less than 3 μV, both of which are intended to support low noise and strong loudspeaker control.

Gain: Amplifier gain is adjustable in 3 dB increments, allowing users to better match the Telos 9800 with different source components and system configurations.

Analog Signal Path: The Telos 9800 uses a fully analog signal path from input to output and incorporates thermal and short-circuit protection. An automatic shutdown system is designed to protect both the amplifier and connected loudspeakers in the event of an operating fault.

Connections: The Telos 9800 includes analog and digital inputs, including RCA and XLR connections. The rear panel also features multiple loudspeaker binding posts, a ground-lift switch, a universal power connection, and a 12-volt trigger input for external control.

Power Management System: Goldmund’s proprietary power-management system combines 10 kVA of transformer capacity with the largest capacitor bank the company has developed to date, providing 648 mF of stored energy. Custom capacitors, in-house-designed transformers, and a redesigned amplification stage using next-generation power boards are intended to improve stability, instantaneous current delivery, and loudspeaker control under demanding loads.

Goldmund Telos Mono Power Amps Comparison

The Bottom Line 

The Goldmund Telos 9800 occupies a rather lonely corner of the high-end audio market where 1,560 watts into 8 ohms, stability down to 1 ohm, a 10 kVA power supply and 648 mF of energy storage are considered reasonable engineering targets. Its new two-unit architecture, which physically separates the power supply from the amplification stage, is arguably more interesting than the headline power figure because it shows how far Goldmund was willing to go to improve isolation, current delivery and thermal management.

There are alternatives at this level, most notably the Dan D’Agostino Relentless Epic 1600, Boulder 3050 and CH Precision M10, although each approaches the problem somewhat differently. Anyone spending $500,000 on amplification is well beyond conventional notions of value, and system matching becomes far more important than shopping from a specification sheet.

For that reason, Goldmund’s own passive loudspeakers are probably the safest and most logical place to start. Models such as the Tethys Passive keep the amplifier and loudspeaker within the same engineering ecosystem, whereas Goldmund’s flagship Gaia and Apologue speakers already incorporate their own Telos amplification and therefore do not require the 9800.

Is the Telos 9800 necessary? Of course not. Neither is a penthouse overlooking Lake Geneva. At this altitude, that stopped being the point several hundred thousand dollars ago.

Price & Availability

The Goldmund Telos 9800 is priced at CHF 400,000 per unit, approximately £370,000, €430,000, or $500,000 USD.

For more information: goldmund.com

Related Reading:

Industrial and commercial applications accounted for more than 70pc of humanoid robot shipments.

Humanoid robot sales have skyrocketed 272pc in a year as the maturing technology proves its use in industrial settings, a new report finds.

China remains the centre of this booming industry, holding more than 97pc of the market, while representing more than 85pc of the global demand.

Sales are further expected to triple year-over-year by 2026 to around 60,000 units, reported Smart Analytics Global (SAG), with industry-wide revenue expected to hit more than $1.6bn. The sector is expected to grow from nearly $5.5bn in 2026 to more than $50bn by 2035.

Shipments grew from just more than 5,000 units to more than 19,000 in the first half of this year, bolstered by government led support from China – including helping developers test and deploy robots – abundant funding and emerging businesses that are expanding through public listings in the country.

Hangzhou-based Unitree’s Shangai listing received nearly 10m retail orders, marking an oversubscription of more than 5,500 times, as the company readies to become mainland China’s first publicly traded humanoid robot maker.

Advancements in physical AI are also attracting innovative robotics start-ups, major tech companies and automakers.

Domestically, Shanghai-based Agibot overtook Unitree to become the world’s largest humanoid robot vendor capturing 44pc of the global market. Together, the two vendors account for 75pc of robot sales across the world. Behind the two leaders are Beijing-based Galbot, Shenzen’s Ubtech and Guangdong-based Leju.

Major sellers include half-size bipedal robots, which dominated Agibot’s its humanoid portfolio and wheeled robots designed for more efficient mobility, stability and cost, over fully human-like locomotion.

Home robots still far off

Industrial and commercial applications accounted for more than 70pc of humanoid robot shipments in the first half of this year – up from 50pc in the same time last year, SAG said.

The growth comes as vendors narrow in on manufacturing, logistics, warehousing and other structured commercial environments, where robots can perform defined tasks and demonstrate measurable productivity.

Advanced use cases such as bionic humanoid robots targeting human interaction, for example, are much slower to grow on account of technology and regulatory limitations around AI, and customer acceptance.

The analytics firm said general-purpose home-service humanoid robots, something Meta is working towards with its recent acquisition of Assured Robot Intelligence, is unlikely to reach mass market scale in the next five years.

Reports suggest that Meta has made “significant” investments in this category with goals to create humanoid robotic hardware to help with household chores.

Recent US restrictions on foreign-made robots could create additional issues for Chinese sellers looking to expand into mature markets, the report found.

Similarly, the EU’s scrutiny over AI applications across autonomous robots in manufacturing and personal assistance also places hurdles for growth.

Meanwhile, US Big Tech is aiming to expand into robots that interact with humans, including Amazon, which acquired New York-based Fauna Robotics in March. Across the pond, UK-based AI and robotics company Humanoid secured $152m in July, in the largest-ever Series A for a humanoid-first robotics company in Europe.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.