Canva reports data breach impacting more than 420 organisations

Australian design software firm Canva disclosed a data breach involving sensitive information linked to more than 420 organisations and institutions in Türkiye.

 

Canva is an Australian visual communication platform for creating presentations, social media graphics, documents, and marketing materials. It uses Canny, an AI-powered feedback platform that allows users to submit and upvote feature ideas, bug reports, and design requests.

 

Recently, Turkish media reported that Canva notified Türkiye’s Personal Data Protection Authority (KVKK) of a breach following a security incident at its third-party service provider, Canny. 

 

According to the incident report, threat actors exploited a compromised connection involving one of Canny’s data processors to gain unauthorised access to the system. The attackers were subsequently able to extract data from the affected environment, potentially exposing confidential information associated with 424 organisations and institutions in Türkiye.

 

The compromised data consisted of employee and corporate information, including their names, business email addresses, workplace details, and company telephone numbers. In cases where organisations had provided documents to Canva, the breach also involved customer order forms, data protection agreements, master service agreements, invoices, and other business correspondence exchanged between Canva and the affected organisations.

 

A Canva spokesperson has, however, confirmed that the company’s own platform and systems were not compromised. The spokesperson added that Canva user accounts, passwords, designs, and other content remain secure.

 

“The unauthorized access to Canny may have allowed access to some limited routine business and contact information through its connection to our customer relationship tool. We immediately removed Canny’s access and have taken the appropriate steps to notify affected customers and regulators where required,” the spokesperson added.

 

The Personal Data Protection Board said its investigation into the incident is still ongoing, and the number of affected individuals has yet to be determined.