- Canva says hackers got into Canny, a tool it used for product feedback, and accessed some business customer records.
- A group called Seven Deadly Sins claims it stole over two million records and sold them, but no one has confirmed this.
- Canva says its main platform, user accounts, passwords, designs and content were not hacked.
Australian design company Canva has confirmed a security problem linked to one of its partner tools. A hacker group says it stole millions of records, but that claim remains unproven.
The problem began with Canny, a tool Canva used to collect feedback on its products. Another company runs Canny, so it counts as a third-party tool. That means Canva did not run the tool itself. Reports say the attacker used Canny’s link to reach Canva’s Salesforce account.
Canva says its core platform stayed safe. The company says user accounts, passwords, designs and content were not exposed. The hackers describe the case very differently. They say they hold far more data than Canva admits.
Canva Confirms Hackers Reached Business Customer Records
Someone entered Canny’s systems without permission. That person then used Canny’s link to Canva’s Salesforce account. The attacker saw some records that belong to Canva’s business customers. Reports say the exposed data included business contact details and contract information.
A similar case involves threat actors claiming an alleged e-Benefits Prévoyance data breach via an API flaw, highlighting the risks of unauthorized access to business and customer data.
Think of Canny as a side door into a building. The front door stayed locked, but the side door led to some business files. Canny told Canva about the problem on 29 August 2026. Canny said it was checking who had entered its systems. According to reports, the leaked information was limited. Canva also told reporters that its main platform and databases were not hacked.
Canva spoke up again after hackers named the company online. The group Seven Deadly Sins listed Canva on its darknet leak site on 16 October. The group says it took more than two million Salesforce records. It also says it took business license orders and billing PDFs. The hackers published one sample document as well. It looks like a Canva for Enterprise order form.
The dates show a gap of about seven weeks. Canva reported its problem on 29 August. Hackers listed Canva on 16 October.
Hackers Say They Sold the Stolen Data, but Proof is Missing
Canva has confirmed the partner tool incident. It has not confirmed the hackers’ numbers. No one has verified the size of the theft. Reporters could not confirm that the group took more than two million records. The hackers also claim a private buyer bought the data. They did not name that buyer. Canva has not confirmed any sale.
Seven Deadly Sins is a fairly new extortion group. It began naming victims in late September 2026. The group had listed eight victims by the time it named Canva. Little public information exists about the group or how it works.
Hungary’s National Cybersecurity Institute also reported the case. The institute shared Canva’s confirmation. It kept that statement separate from the hackers’ unproven claims. This keeps confirmed facts apart from claims that no one has checked.
Canva Says Its Main Platform and User Accounts Stayed Safe
A Canva spokesperson said the Canny problem exposed some business customer records through Salesforce. The data included business contact details and routine business papers. Canva says it removed Canny’s access right away. It told affected customers where needed. It also worked with the right agencies.
The spokesperson said, “Our platform and systems were not hacked. Canva accounts, passwords, designs and content are still safe.”
Reports say nothing so far shows a breach of Canva’s main design platform. Regular Canva users can note the company’s statement. Canva says accounts, passwords, designs and content were not touched in this case.
The case shows a risk for companies that link outside tools to their systems. A partner tool with access to customer records can give attackers another way in. That can happen even when the main platform stays secure. One report calls the case a clear example of supply chain risk.
Experts also warn that real business papers can help criminals. Thieves could use them for fake invoices and payment scams. A fake invoice with real details looks normal to the person who receives it. Kash Sharma, managing director for Asia-Pacific at BlueVoyant, shared advice with reporters. He told companies to review the apps connected to their systems. He also told them to check payment requests through a separate, trusted channel.
Business customers are the group affected here. They should take care now. The confirmed exposure includes contact details and business documents. Customers should watch for unexpected emails, invoices, and contract requests. They should check unusual payment instructions on their own. A separate, trusted channel is the safer way to check. An email alone should not decide whether a payment is real.
The facts fall into two groups. The partner tool problem is confirmed. The claimed theft of more than two million Salesforce records remains unconfirmed. The reported sale of that data is not confirmed either.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Phonelyne Faces Unverified Data Leak Claim Involving eSIM Codes and API Keys
A hacker called DaOnlySpark claims to hold customer, payment, and eSIM records tied to Phonelyne. Th...
BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers
Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the publ...
GitHub Replaces Stargazer Scraping With Privacy-Focused Star History API
GitHub’s new API shows how a repository’s stars grow over time without revealing who sta...
US Flags China-Linked Hackers in Breach of Pacific Regional Organization
The U.S. Embassy says hackers linked to China infiltrated the systems of a regional group in Suva fo...
French Police Shut Down Reacher and Stryx, Arrest Three 17-Year-Olds
French police arrested three 17-year-olds for allegedly operating the Reacher and Stryx stolen data ...
Privacy Concerns Grow Over Meta Muse Profiles of People Who Never Use the App
WIRED and independent researcher Karan Joshi report that Muse’s instructions tell it to build a page...
