Canva 2019 data breach

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

On May 24, 2019, Canva identified their systems were attacked and posted an announcement about the breach, urging users to change their passwords. 139 million users were affected, and information taken includes usernames, real names, email addresses, and location. 61 million users' data included password hashes, and for other users, Google tokens were taken. Seven months later, on the 11th of January 2020, Canva became aware of 4 million user passwords had been decrypted and shared online. Following the discovery, on the 12th of January Canva has forcefully reset the password of every user that had not changed it since the date of the incident.

Background

Information about the product/service history to provide the necessary context surrounding the incident

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

[Incident]

The attack was linked to a group known as GnosticPlayers. The group claimed to exfiltrate data and offered it for sale on breached forums, with motives of financial gain. The breach was caused by credential stuffing and credential cracking. Passwords were hashed with bcrypt; however, they were later decrypted.

The data exfiltrated from the breach included: email addresses, real names, cities and countries of residence, public profile data, and partially hashed passwords (for users logged in directly with Canva, not externally). Payment data was not accessed.

[Company]'s response

Canva alerted users on May 25, 2019, to reset their passwords through email and in app alerts. To improve security, Canva introduced Multi-factor authentication (MFA), enhanced security measures (not specified), and regular security audits.

Lawsuit

If applicable, add any information regarding litigation around the incident here.

Claims

Main claims of the suit.

Rebuttal

The response of the company or counterclaims.

Outcome

The outcome of the suit, if any.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.

Consumer response

Summary and key issues of prevailing sentiment from the consumers and commentators that can be documented via articles, emails to support, reviews and forum posts.

---

Add your text below this box. Once this section is complete, delete this box by clicking on it and pressing backspace.