Canva: some enterprise customers' contact and contract details exposed through feedback vendor Canny's link to Canva's Salesforce (Canva confirmed 21 Sep); Canva repeated this on 19 Oct after a leak-site listing
Canny, a customer-feedback platform used by Sydney-based Canva, told Canva on 29 August 2026 that it was investigating unauthorised access to its systems. Canny was connected to Canva's Salesforce account, so the intruder reached limited information about some Canva enterprise customers, mainly larger customers handled by Canva's sales team.
A Canva spokesperson told Capital Brief (21 September) that the exposed data included business contact details and contract information, that Canva immediately removed Canny's access and notified affected customers, and that Canva's own platform was not compromised and Canva accounts, passwords, designs and content were not accessed.
Other Canny customers have published their own notices. VRChat (18 September) said Canny told it on 28 August that an unauthorised party had accessed one of Canny's internal systems, and that Canny's investigation with an outside forensics firm found no further unauthorised activity after 28 August.
Anaconda (12 October) said it rotated all credentials and integrations connected to Canny and has stopped using it. A group calling itself The Seven Deadly Sins has claimed the attack; Canva has not confirmed the group's claims. The case shows how a SaaS-to-SaaS integration token can carry a vendor breach into a customer's CRM.
Primary: Canva statement via Capital Brief; vendor-side notices: VRChat, Anaconda.
UPDATE 19 October 2026 (Cyber Daily): Canva gave a fresh statement after the leak-site listing, saying unauthorised access to Canny reached 'some enterprise customer records' through its Salesforce connection, including business contact details and routine business documentation; that it removed Canny's access, informed affected customers where required, complied with its obligations and worked with relevant agencies; and that Canva's own platform, accounts, passwords, designs and content were not affected.
Correction (23 Oct 2026): removed The Seven Deadly Sins' own claims about record counts, data types, time inside Canva's systems and a sale; Canva has confirmed only that some enterprise customer records were exposed through Canny. (source: https://www.cyberdaily.au/security/14317-exclusive-aussie-software-giant-canva-confirms-third-party-data-incident)
- Exploited in Australia?
- unknown
- Patch to
- Canva enterprise customers: expect targeted phishing and fake invoice or renewal emails that quote real contract details, and confirm any change to payment or contract terms by phone. Everyone: list the SaaS tools that hold OAuth or API tokens into your CRM, help desk and identity systems; cut each token to the smallest scope it needs, rotate tokens when a vendor reports an incident, and make sure your NDB assessment starts when the vendor tells you, not when their investigation ends.
- Primary: Capital Brief — Canva enterprise customer data exposed in third-party breach (Canva statement, 21 Sep 2026)
- Vendor: VRChat — Canny Security Incident (Canny customer notice, 18 Sep 2026)
- Source: DataBreaches.net — Canva hacked via vendor's Salesforce instance; other customers affected (23 Sep 2026)
- Source: Cyber Daily — Canva confirms third-party data incident (19 Oct 2026, Canva statement)