Canva—Canva enterprise customer data exposed via breach of third-party vendor Canny connected to Canva's Salesforce
Attackers compromised Canny, a customer-feedback platform integrated with Canva's Salesforce environment, gaining unauthorized access to limited enterprise customer information including names, business emails, phone numbers, and business documents such as order forms, invoices, and data protection/master service agreements. Canva said its core product, accounts, passwords, designs, and content were not affected, and it removed Canny's access and notified customers and regulators. Turkiye's Personal Data Protection Authority said the breach affected 424 organizations in the country.
Scoring Impact
| Topic | Direction | Relevance | Contribution |
|---|---|---|---|
| Data Security | -against | primary | -1.00 |
| Overall incident score = | -0.358 | ||
Score = avg(topic contributions) × significance (low ×0.5) × confidence (0.72)
Evidence (3 signals)
Extortion group 'Seven Deadly Sins' posted Canva breach data to darknet leak site, claiming 2M+ Salesforce records sold
Data-extortion group 'The Seven Deadly Sins' (TSDS), which exfiltrated data from Canva's Salesforce environment via the Canny vendor integration around August 26-28, 2026, posted Canva to its darknet leak site on October 16, 2026; Canva publicly confirmed the incident October 19, 2026. TSDS claims to have obtained over 2 million CRM records and 200+ million product-data-warehouse rows, including enterprise licence orders, user seat allocations, and billing attachments, and says the data has been sold to an unidentified private buyer. Canva has not confirmed these larger figures and maintains its core platform, accounts, passwords, designs, and content were not compromised.
Capital Brief: Canva enterprise customer data exposed in third-party breach via Canny/Salesforce integration
Capital Brief reported Canva confirmed a breach of the third-party Canny platform exposed limited enterprise customer contact information and business documents through Canva's Salesforce integration, while Canva's core product remained unaffected.
Turkiye Today: Third-party data breach linked to Canva affects 424 organizations in Turkiye
Turkiye Today reported the country's Personal Data Protection Authority (KVKK) said the Canva-linked third-party breach affected 424 organizations and institutions in Turkiye.