Klaviyo Inc

October 2024 Cybersecurity Incident

On October 25, 2024, the Company determined that an unauthorized third party gained access to the Company's source code, as well as other system and application credentials. Following detection of this unauthorized activity, the Company initiated its response protocols and took steps to contain, assess and remediate the incident, including launching an investigation with the assistance of counsel and leading external cybersecurity experts. Although the investigation is ongoing, as of the date of this Quarterly Report on Form 10-Q, the Company has found no evidence of continued unauthorized activity on its systems and has contained the incident. The Company’s operations have continued throughout this matter in all material respects.

As of the date of this Quarterly Report on Form 10-Q, the Company does not expect that the incident is reasonably likely to have a material impact on the Company’s business, including its financial condition or results of operations.

Securities Trading Plans of Directors or Executive Officers

(c)During the three months ended September 30, 2024, two of the Company’s officers (as defined in Rule 16a-1(f) under the Exchange Act) each adopted a written plan intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) of the Exchange Act for the sale of the Company’s securities, as set forth in the table below.

No other directors or officers (as defined in Rule 16a-1(f) under the Exchange Act)adopted and/orterminated a “Rule 10b5-1 trading arrangement” or a “non-Rule 10b5-1 trading arrangement,” each as defined in Regulation S-K Item 408, during the three months ended September 30, 2024.