Breaches and incidents
Canva: enterprise customer records exposed via compromised third-party feedback tool Canny
Turkey’s Personal Data Protection Board published a decision dated 16 Sep stating the breach affected 424 organizations in Turkey, exposing names, business...
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Turkey’s Personal Data Protection Board published a decision dated 16 Sep stating the breach affected 424 organizations in Turkey, exposing names, business emails, workplace locations, corporate phone numbers and business documents such as order forms, agreements and invoices (Turkiye Today). Canva said “The unauthorised access to Canny allowed access to some enterprise customer records” (Cyber Daily).
- Root cause: compromise of Canny, a third-party product feedback tool connected to Canva’s Salesforce customer relationship tool, per Canva; innovaTopia reports Canny told Canva on 29 Aug it was investigating unauthorized access (citing Capital Brief).
- The Seven Deadly Sins group listed Canva on its leak site on 16 Oct, claiming more than 2 million Salesforce records, licence orders and billing PDFs and a sale to a “private buyer”; these claims are unverified (Cyber Daily). Other outlets report a 200-million-row claim, also unverified.
- Canva said its “own platform and systems were not compromised”, that it “immediately removed Canny’s access”, and notified affected customers and regulators where required.