What happened
In May 2019 the Australian design platform Canva was breached [canva-sophos], [canva-ia]. Reporting said the exposed data included usernames, names, email addresses and city/country, with bcrypt-hashed passwords for a subset of users (around 61 million, as reported) [canva-ia]. A figure of about 139 million users was widely reported, but it originated from the group that claimed the attack (GnosticPlayers); Canva did not confirm a count, so none is asserted here [canva-sophos], [canva-ia], [canva-media]. Canva disclosed the breach and encouraged users to change their passwords [canva-sophos].
Timeline
- 2019-05-24 — Canva detected the breach in progress and disclosed it [canva-sophos].
- 2019-05-28 — Media reported the attacker’s claim of ~139M users; Canva did not confirm a count [canva-sophos], [canva-ia].
Current status
Disclosed. Canva encouraged users to change their passwords [canva-sophos]. No regulator action has been reported. The user count is the attacker’s claim as reported and is not asserted as fact.
Why it matters
One of the largest breaches to originate from an Australian company, with impact spread across a global user base.