Canva has confirmed that some enterprise customer records were exposed in a cyber security incident disclosed on 19 October 2026, after a ransomware group claimed to have stolen and sold data accessed through a third-party tool connected to the design platform’s Salesforce account.
The Australian technology company said the incident involved Canny, a third-party service used to collect product feedback, whose connection to Canva’s Salesforce account allowed unauthorised access to business contact details and routine documentation.
A Canva spokesman told Cyber Daily that the company had taken immediate action to contain the incident. “We immediately removed Canny’s access, informed affected customers where required, and have complied with our obligations and collaborated with relevant agencies in the best interest of our community,” the spokesman said.
The company stressed that its own platform and systems had not been compromised, adding that customer accounts, passwords, designs and content remained secure.
The ransomware group Seven Deadly Sins claimed responsibility in a 16 October post on its darknet leak site, alleging that it had obtained more than two million Salesforce records, enterprise licence orders and billing PDFs. The group published a sample document that appeared to be a legitimate Canva for Enterprise order form as evidence of the alleged breach.
Seven Deadly Sins claimed the stolen data had already been sold to an unidentified “private buyer”. The claim has not been independently verified, and the extent of the data exposure remains unclear.
The incident highlights the potential risks associated with third-party services that have access to corporate systems and customer information, even when a company’s core platform remains unaffected.
According to Cyber Daily, Seven Deadly Sins is a recently emerged ransomware operation that claimed its first victim in late September. The group has since claimed responsibility for eight victims, although little is publicly known about its operators or activities.
The incident adds to Canva’s history of cyber security problems. The company suffered data breaches in 2019 and 2020 that exposed tens of millions of users’ records, including real names, usernames and passwords.
Following the 2020 incident, Canva reset the passwords of users who had not changed them since the initial breach in January of that year.
Canva has more than 265 million monthly active users and employs approximately 5,500 people, with offices across Australia and internationally. Its partners include Netflix, Warner Music Group and YouTube.
