Teollimi

Canva data breach

Was I affected?

Canva confirmed a breach affecting an undisclosed number of people, exposing names, email addresses and phone numbers. You may be affected if your employer has a Canva for Teams or Canva Enterprise contract and you are listed as a contact on that account.

Canva breach facts
AnnouncedSep 16, 2026
CountrySeveral countries
Data exposedNames, Email addresses, Phone numbers and Other details
Through a vendorCanny
StatusConfirmed by the company or a regulator filing

What happened

Canva says unauthorized access to Canny, a third-party tool it used to collect product feedback, gave attackers access to some enterprise customer records through Canny's connection to Canva's Salesforce account. In its notice to Turkey's data protection authority, published September 16, 2026, Canva said the exposed data includes names, work email addresses, work locations and work phone numbers of its business customers' employees, plus order forms, contracts, invoices and other routine business documents; 424 organizations in Turkey were affected and the number of people was not yet known. Canva says its own platform was not compromised and that Canva accounts, passwords, designs and content are secure. A group called Seven Deadly Sins later claimed the theft.

What should I do?

  1. Watch for invoice, renewal or payment-change emails that look like they come from Canva; check any request to change bank details by phone with a known contact.
  2. Be careful with emails that quote your company's Canva contract or order details, since those documents were taken.
  3. Your Canva login and designs were not affected, but turning on two-step verification in Canva is still a good idea.
XRedditWhatsApp

Check the other services you use →

Sources