Skip to content
InYourGeek
visiteur@inyourgeek — shell
↹ compléter↑↓ historique⏎ ouvrirhelp
FR
← Back to the register

Canva

ModerateConfirmedDigital services

Canny, a customer-feedback vendor connected to Canva's Salesforce account, was compromised between 26 and 28 August 2026 by a group calling itself "The Seven Deadly Sins". The access to Canny allowed exfiltration of information on Canva's enterprise customers: names, business email addresses, phone numbers, workplace locations, and contractual documents (order forms, invoices, data protection agreements). Canva states that user accounts, passwords and content were not affected, and it has begun notifying impacted customers, including more than 420 organizations identified in Türkiye. The total number of individuals whose data was exposed has not yet been determined.

These business contact details and contract documents could be used for targeted phishing or impersonation against the procurement and legal teams of Canva's enterprise customers.

Disclosed on
September 23, 2026
Incident dated
August 26, 2026
Sector
Digital services
Country
Australia
Cause
Third-party provider

Exposed data

  • Full name
  • Email address
  • Phone number
  • Employment data
  • Other personal data

You are only affected if you had an account or an order with this organisation.

What you can do

  • Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
  • You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact