Canva: some enterprise customers' contact and contract details exposed through feedback vendor Canny's link to Canva's Salesforce (Canva confirmed 21 Sep); 'The Seven Deadly Sins' leak-site listing claims far more (recorded 16 Oct, unverified)
Canny, a customer-feedback platform used by Sydney-based Canva, told Canva on 29 August 2026 that it was investigating unauthorised access to its systems. Canny was connected to Canva's Salesforce account, so the intruder reached limited information about some Canva enterprise customers, mainly larger customers handled by Canva's sales team. A Canva spokesperson told Capital Brief (21 September) that the exposed data included business contact details and contract information, that Canva immediately removed Canny's access and notified affected customers, and that Canva's own platform was not compromised and Canva accounts, passwords, designs and content were not accessed. Other Canny customers have published their own notices. VRChat (18 September) said Canny told it on 28 August that an unauthorised party had accessed one of Canny's internal systems, and that Canny's investigation with an outside forensics firm found no further unauthorised activity after 28 August. Anaconda (12 October) said it rotated all credentials and integrations connected to Canny and has stopped using it. A group calling itself The Seven Deadly Sins told DataBreaches.net (23 September) that it attacked Canny on 28 August and spent more than 72 hours inside Canva's systems. Its leak-site listing, which ransomware.live recorded on 16 October, claims Canva's entire Salesforce org (more than 2 million CRM records), a product data-warehouse export of more than 200 million rows, enterprise licence orders, contracts, seat allocations and billing attachments. Canva has not confirmed those claims. The case shows how a SaaS-to-SaaS integration token can carry a vendor breach into a customer's CRM. Primary: Canva statement via Capital Brief; vendor-side notices: VRChat, Anaconda; claim: DataBreaches.net and ransomware.live.
- Exploited in Australia?
- unknown
- Patch to
- Canva enterprise customers: expect targeted phishing and fake invoice or renewal emails that quote real contract details, and confirm any change to payment or contract terms by phone. Everyone: list the SaaS tools that hold OAuth or API tokens into your CRM, help desk and identity systems; cut each token to the smallest scope it needs, rotate tokens when a vendor reports an incident, and make sure your NDB assessment starts when the vendor tells you, not when their investigation ends.
Primary: Capital Brief — Canva enterprise customer data exposed in third-party breach (Canva statement, 21 Sep 2026) · Vendor: VRChat — Canny Security Incident (Canny customer notice, 18 Sep 2026) · DataBreaches.net — Canva hacked via vendor's Salesforce instance; other customers affected (23 Sep 2026)