Reading
Canva wasn't hacked. Its feedback tool was. Should you care?
Canva says your designs and password are safe, but a hacker group claims 2M Salesforce records. Who's exposed, and what enterprise teams should ask now.
Prices last read 2026-10-19
Short answer
If you're on a regular Canva account, Canva says your account, password and designs were not touched. The exposure involved some enterprise customer records held in Canva's Salesforce.Canva says an attacker got into Canny, a third-party tool it used to collect product feedback. Because Canny was connected to Canva's Salesforce account, that access reached some enterprise customer records, including business contact details and routine business documents. Canva told Cyber Daily that its own platform and systems were not compromised and that accounts, passwords, designs and content remain secure. The people with something to worry about are Canva Enterprise customers whose sales and contract details sat in that CRM.Source: Exclusive: Aussie software giant Canva confirms third-party data incident (Cyber Daily) · 2026-10-19
What Canva has actually confirmed
According to Capital Brief, Canny told Canva on 29 August that it was investigating unauthorised access to its systems. Through the Canny–Salesforce connection, someone could see information mostly about larger enterprise customers handled by Canva's sales team: business contact details and contract information. Canva said it immediately removed Canny's access and took steps to notify affected customers. Capital Brief first reported the incident on 21 September.
Source: Canva enterprise customer data exposed in third-party breach (Capital Brief) · 2026-10-19
On 19 October, Cyber Daily reported that a Canva spokesperson confirmed the incident again. The spokesperson said access to Canny 'allowed access to some enterprise customer records' through its link to Canva's Salesforce account. Canva says it informed affected customers where required and worked with the relevant agencies. Cyber Daily does not say how many customers were notified.
Source: Exclusive: Aussie software giant Canva confirms third-party data incident (Cyber Daily) · 2026-10-19
Why this is back in the news: the hacker claims
Canva confirmed the incident again because a group calling itself The Seven Deadly Sins listed Canva on its dark-web leak site in mid-October. Cyber Daily reports that the group claims more than two million Salesforce records, enterprise licence orders and billing PDFs. The group says it has already sold the data to a 'private buyer'. It posted one sample, which Cyber Daily says appears to be a genuine Canva for Enterprise order form. Escudo Digital reports a larger claim: more than 200 million database rows in total, including data from a corporate data warehouse. Escudo Digital also notes that threat-tracking firms say the claims have not been verified. None of the reporting we read confirms the sale, the numbers, or that the group's haul matches the Canny incident.
Source: Exclusive: Aussie software giant Canva confirms third-party data incident (Cyber Daily) · 2026-10-19; Hackers claim to have stolen more than 200 million database records from Canva (Escudo Digital) · 2026-10-19
Don't merge two different stories
There are two separate things here. One is Canva's confirmed statement about Canny. The other is the group's unverified sales pitch. Hackers inflate numbers to raise prices, and companies minimise numbers to protect trust. Until someone produces evidence, treat '2 million' and '200 million' as claims, not facts.
Source: Hackers claim to have stolen more than 200 million database records from Canva (Escudo Digital) · 2026-10-19
Our take: the weakest point is the plugins, not the product
The most annoying part of this story is the line 'our platform was not compromised.' It's technically reassuring and practically beside the point. Nobody broke into Canva's design engine, but they didn't need to. A feedback widget had a live connection to the sales CRM, and that CRM holds who pays, how much, and who signs the cheques. Every SaaS company adds these tools: feedback boards, CRM syncs, support desks. Each one is another door. Canva is hardly unique here, and in our view the industry still underrates how much risk these 'harmless' integrations carry.
Our second complaint is about transparency. 'Business contact details and routine business documentation' is vague. If you pay for Canva Enterprise, you should be able to get a straight list: names, emails, phone numbers, contract values, order forms, invoices? A 'routine' order form is exactly the document a phishing crew needs to send a convincing fake renewal invoice. In our view, paying customers deserve the specifics, not a soothing summary.
Canva cannot ensure or warrant the security of any information you transmit to Canva.
Canva Privacy Policy, last updated 25 August 2026Source: Canva Privacy Policy · 2026-10-19
Why this quote matters: the same policy says Canva shares information with vetted third-party service providers and gives them only the access 'reasonably necessary'. Canny is the sort of outside tool that sentence describes. The policy promises appropriate safeguards, not a guarantee. When we read it today, it also contained no specific commitment about notifying users of a breach.
Source: Canva Privacy Policy · 2026-10-19
What to do now (our suggestions)
- Personal, Pro or Education user: nothing in the confirmed reporting says you need to act. Canva says accounts and passwords were not accessed.
- Enterprise admin: ask your Canva account contact in writing whether your organisation's records were in scope, and exactly which fields and documents were involved.
- Finance teams: be suspicious of any 'updated bank details' or urgent renewal invoice that looks like it came from Canva. Check it against a contact you already know before paying.
- Security teams: list every third-party tool connected to your own CRM and remove access for any you no longer use. This is the lesson of the story, whatever happens with Canva.
Optional: see a seller listing for Canva plans (a reseller listing, not official Canva access and not an endorsement). That link carries our partner code Sk52g, which is how a purchase is attributed to this site. Promotion code UPD3S.
Sources (all read 19 October 2026)