Data breach
Canva.com data breach
In 2019, Canva.com suffered a data breach affecting 134,050,884 records. Exposed data included email addresses, phone numbers, username and 7 other types of data.
Breach date
134.1 million
Records in the breach
10
Types of data exposed
Were you affected by the Canva.com breach?
Enter your email address to see whether it appears in this breach — or any of the other breaches in Leak Database.
Data exposed in the Canva.com breach
- Email Addresses
- Phone Numbers
- Username
- Display Name
- Names
- Surname
- Website
- Country
- Personal Brand
- Avatar
About the breach
Canva experienced a recent cyber incident disclosed on October 19, 2026, involving enterprise customer data exposed through a third-party feedback tool.
(Note: If you meant the popular educational platform Canvas by Instructure, it suffered a major ransomware attack and data breach by ShinyHunters in May 2026.)
Canva Cyber Incident (October 2026)
• What Happened: The ransomware group Seven Deadly Sins gained unauthorized access to business contacts and routine documentation.
• How It Happened: The attackers exploited a third-party feedback tool called Canny that was connected to Canva's Salesforce account.
• Compromised Data: Over two million Salesforce records, enterprise license orders, and billing PDFs were allegedly stolen.
• What Was Safe: The core Canva design platform, standard user accounts, user passwords, and private graphic designs remained uncompromised.
• Canva's Response: Canva immediately revoked Canny's access, notified affected enterprise customers, and collaborated with relevant cybersecurity and law enforcement agencies.
Historical Canva Breach (May 2019)
If you are looking for Canva's major historical security event:
• Date: May 24, 2019
• Impact: Affected up to 139 million user profiles.
• Exposed Data: Usernames, real names, email addresses, countries, bcrypt-hashed passwords, and unaccessed Google OAuth tokens.
• Response: Canva forced password resets, reset OAuth tokens, and partnered with security firms.
(Note: If you meant the popular educational platform Canvas by Instructure, it suffered a major ransomware attack and data breach by ShinyHunters in May 2026.)
Canva Cyber Incident (October 2026)
• What Happened: The ransomware group Seven Deadly Sins gained unauthorized access to business contacts and routine documentation.
• How It Happened: The attackers exploited a third-party feedback tool called Canny that was connected to Canva's Salesforce account.
• Compromised Data: Over two million Salesforce records, enterprise license orders, and billing PDFs were allegedly stolen.
• What Was Safe: The core Canva design platform, standard user accounts, user passwords, and private graphic designs remained uncompromised.
• Canva's Response: Canva immediately revoked Canny's access, notified affected enterprise customers, and collaborated with relevant cybersecurity and law enforcement agencies.
Historical Canva Breach (May 2019)
If you are looking for Canva's major historical security event:
• Date: May 24, 2019
• Impact: Affected up to 139 million user profiles.
• Exposed Data: Usernames, real names, email addresses, countries, bcrypt-hashed passwords, and unaccessed Google OAuth tokens.
• Response: Canva forced password resets, reset OAuth tokens, and partnered with security firms.
How to protect yourself
In order to start protecting yourself from possible fraud in future, we highly recommend the following steps:
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
3. Be careful of spam calls and emails. Install an app like True Caller to assist you in identifying possible spam or scam calls.
1. Immediately change your password on the affected website, but also any other website where you may re-use this password.
2. Download the Google or Microsoft Authenticator App on your mobile device. Activate 2FA authentication on any website you use, which allow for it.
3. Be careful of spam calls and emails. Install an app like True Caller to assist you in identifying possible spam or scam calls.
Get told about the next breach
A free Leak Database account emails you when your address appears in a newly added breach.