---
title: "Data breach at Canva"
description: "Canny, a customer-feedback vendor connected to Canva's Salesforce account, was compromised between 26 and 28 August 2026 by a group calling itself \"The Seven Deadly Sins\". The access to Canny allowed exfiltration of information on Canva's enterprise customers: names, business email addresses, phone "
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-23-canva
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-23
dateModified: 2026-09-23
---
# Canva

Data breach — Moderate

Canny, a customer-feedback vendor connected to Canva's Salesforce account, was compromised between 26 and 28 August 2026 by a group calling itself "The Seven Deadly Sins". The access to Canny allowed exfiltration of information on Canva's enterprise customers: names, business email addresses, phone numbers, workplace locations, and contractual documents (order forms, invoices, data protection agreements). Canva states that user accounts, passwords and content were not affected, and it has begun notifying impacted customers, including more than 420 organizations identified in Türkiye. The total number of individuals whose data was exposed has not yet been determined.

These business contact details and contract documents could be used for targeted phishing or impersonation against the procurement and legal teams of Canva's enterprise customers.

| Fact | Value |
| --- | --- |
| Disclosed on | September 23, 2026 |
| Incident dated | August 26, 2026 |
| Sector | Digital services |
| Country | Australia |
| Cause | Third-party provider |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Full name
- Email address
- Phone number
- Employment data
- Other personal data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Canva hacked via vendor’s Salesforce instance; Other customers affected as well](https://databreaches.net/2026/09/23/canva-hacked-via-vendors-salesforce-instance-other-customers-affected-as-well/) — DataBreaches.net
- [Canva enterprise customer data exposed in third-party breach](https://www.capitalbrief.com/article/canva-enterprise-customer-data-exposed-in-third-party-breach-b926931e-7c1b-4c1e-9f55-a3354cb0a1ed/) — Capital Brief
- [Canva reports data breach impacting more than 420 organisations](https://www.teiss.co.uk/news/canva-reports-data-breach-impacting-more-than-420-organisations-18202) — teiss
- [Canva breach affects data linked to 424 organizations in Türkiye](https://www.dailysabah.com/business/economy/canva-breach-affects-data-linked-to-424-organizations-in-turkiye) — Daily Sabah
- [Canva Enterprise Data Exposed Through Third-Party Canny Platform Breach](https://beyondmachines.net/event_details/canva-enterprise-data-exposed-through-third-party-canny-platform-breach-4-p-9-f-h) — Beyond Machines

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-23-canva
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees