Canva says attackers who broke into Canny exposed a slice of its enterprise customer records via that feedback service’s link to its Salesforce account. A new extortion crew, Seven Deadly Sins, claims it took millions of records and sold them, though none of this has been verified.
What happened
On 19 October 2026 Canva, the Australian design platform, told Cyber Daily that “some enterprise customer records” had been exposed in a security incident at a third-party tool. That tool is Canny, a service Canva uses to collect feature requests and product feedback. Canny was connected to Canva’s Salesforce environment, and that connection let an unauthorised party reach business contact details and what the company described as routine business documentation.
Canva says it pulled Canny’s access straight away, told affected customers where it was required to, and worked with the relevant agencies. A spokesperson quoted by Cyber Daily said: “We immediately removed Canny’s access.” It insists its own platform, user accounts, passwords and designs are untouched.
The confirmation came a few days after the group calling itself Seven Deadly Sins added Canva to its dark web leak site. Escudo Digital dates the listing to 15 October, while Cyber Daily puts it at 16 October. The group claims it took more than two million Salesforce records, plus enterprise licence orders and billing PDFs. Escudo Digital says the group’s original post claimed more than 200 million database rows in all, including data from a corporate data warehouse. Seven Deadly Sins also says the data has been sold to an unnamed “private buyer”. It posted a single sample that appears to be a genuine Canva for Enterprise order form. Nobody has independently verified any of these claims, and Canva has not said how many organisations or people were affected.
This is not a new breach so much as the next stage of an old one. According to Escudo Digital, which cites Australian outlet Capital Brief, Canny told Canva on 29 August that it was investigating unauthorised access to its systems. In September, teiss reported that Canva had notified Türkiye’s data protection authority, the KVKK, that information linked to 424 Turkish organisations was involved.
The technical picture
From what has been made public, this was a supply chain compromise one step removed from the victim. The attackers did not need to get past Canva’s own defences. They compromised Canny, and teiss says the incident report sent to the Turkish regulator described a compromised connection involving one of Canny’s own data processors. From there they used the trust Canva had already granted. Feedback tools are typically wired into a CRM with standing API access to account and contact records.
That standing access is the weak point. A connected app authorised to read CRM objects can usually do so around the clock, without the multi-factor prompts and conditional access checks that apply to human users. If the third party is compromised, its tokens or credentials work just as well for the intruder. Because they use legitimate interfaces, the theft can look like normal synchronisation.
The data types matter as well. The Turkish filing, as reported by teiss, listed staff names, business email addresses, workplace details and phone numbers, plus any contracts, invoices, order paperwork and data protection agreements that customers had supplied. None of that is a password or a payment card, but it is exactly the material a fraudster needs.
Why it matters for UK organisations
Canva is a staple in UK marketing departments, schools, universities, charities and local government, and many larger users are on Canva for Enterprise contracts. Canva has not published any breakdown by country. That means no UK customer can safely assume it is unaffected, and the Turkish disclosure shows that the exposure covered organisations well beyond Australia.
The most immediate risk is fraud, not identity theft. Real order forms and invoices show who signs off purchases, what licence volumes and prices look like, and when renewals fall due. Cyber Daily quoted BlueVoyant’s Kash Sharma calling the incident “a textbook case of how risk travels through the supply chain”. He warned that genuine billing documents can fuel convincing invoice and renewal scams. A fake Canva renewal notice with the right purchase order number and contact names would be very hard for a busy accounts payable team to spot.
There is also a data protection angle. Business contact details of named staff are personal data under UK GDPR. Canva has said it told customers “where required”, but organisations that received a notification should log it and decide whether their own obligations are triggered.
Expert view
When we test SaaS-heavy organisations, the integrations list in the CRM is one of the first things I ask to see, and it is rarely short. Marketplace apps, feedback widgets, enrichment services and analytics connectors build up over the years. Each was approved for a sensible reason; few are ever reviewed again. The scopes they hold are often far broader than the feature needs, because the default install asks for everything.
What stands out here is the gap between the first compromise and the public extortion. Canny reportedly raised the alarm at the end of August, and the leak site post arrived in mid-October. That is a familiar pattern: data leaves quietly, the vendor handles notification, then weeks later criminals try to monetise it or build a reputation. A brand-new group naming a household-name victim has every reason to inflate its numbers, so I would treat the 200 million row figure with real scepticism. The order form sample, though, suggests some genuine commercial paperwork is out there, and that is enough to act on.
Note that Canva’s statement and the attackers’ claims need not contradict each other. “Our platform was not compromised” can be true while customer data held in a connected CRM was still taken.
What to do now
- Warn finance and procurement today. Tell accounts payable to verify any Canva invoice, renewal or change of bank details through a known contact or the vendor portal, never through details in the email itself. Report suspicious requests to Action Fraud and your bank.
- Ask Canva for clarity. If you hold an enterprise contract, request written confirmation of whether your organisation’s records or documents were included, and keep the answer for your data protection records.
- Brief the named contacts. Staff who appear on order forms or contracts are the likeliest phishing targets.
- Audit your own connected apps. Review every third-party integration in Salesforce, Microsoft 365, Google Workspace and similar platforms. Remove unused ones and cut scopes back to the minimum. This maps directly to the Cyber Essentials controls on user access control and secure configuration.
- Monitor integration activity. Put API usage by connected apps into your logging, and alert on unusual export volumes or access from unfamiliar infrastructure.
- Tighten supplier assurance. Ask suppliers about their own processors and integrations, and set breach notification timelines in contracts.
Bottom line
Canva’s core platform may well be intact, but its enterprise customers’ commercial paperwork appears to have travelled through a feedback tool most of them had never heard of. Treat any unexpected Canva billing request with suspicion. Then take a hard look at the apps quietly plugged into your own CRM.
Sources
- Cyber Daily: Exclusive: Aussie software giant Canva confirms third-party data incident
- Cyber Daily: What next? Canva’s most recent third-party incident a ‘textbook case’ of supply chain risk
- National Technology: Canva confirms enterprise customer data exposed in third-party cyber incident
- Escudo Digital: Hackers claim to have stolen more than 200 million database records from Canva
- teiss: Canva reports data breach impacting more than 420 organisations
