Canva canva.com Canva data breach: what happened and what to do
In May 2019 an attacker took user data from Canva. Have I Been Pwned lists 137,272,116 accounts, with email addresses, usernames, names, locations and passwords stored as hashes.
View all 13,115 breaches- Breach date
- 24 May 2019
- Affected
- 137,272,116
- Data exposed
- Email addresses, Geographic locations, Names, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Canva, the online design tool, was breached in May 2019. Have I Been Pwned (HIBP) dates the breach to 24 May 2019, the day the attacker contacted a news site and said they had got in only hours earlier. HIBP added the data on 9 August 2019 and lists 137,272,116 affected accounts.
Canva said it had no evidence that any user credentials had been compromised, and it told people to change their passwords as a precaution. Reporting at the time also said Canva reset passwords for accounts that hadn't changed theirs in the previous six months. Secondary outlets put the number of users at about 139 million. Use HIBP's figure for the count, since it's the number of accounts in the data HIBP received.
What was exposed
HIBP lists five types of data: email addresses, usernames, names, geographic locations and passwords. The passwords weren't stored as plain text. According to HIBP they were bcrypt hashes, and only for users who signed up with a password instead of a Google or Facebook login. Bcrypt is deliberately slow to crack, which is the good news. A hash of a weak password can still be guessed, though, and a short common password falls first.
Some reports said payment details were taken. Only one source said so and nothing else backed it up, so don't assume your card was involved.
What that lets criminals do
An email address with a real name and a city is enough for a convincing phishing message. It might claim to be from Canva, about a design, a subscription or a "security update".
Credential stuffing is the bigger risk. People reuse passwords, so attackers take email and password pairs from one breach and try them on other sites. If you used your Canva password anywhere else, that's the account to worry about, not Canva.
Usernames matter less on their own, but they link your Canva identity to the same handle on other services. That makes you easier to profile.
The company's response
Canva told users to change their passwords and reset them for some accounts. Check Canva's help pages for how to change yours and turn on two-step verification. The breach is old, and a password you set after mid-2019 wasn't in this data. If you haven't changed an older one since, do it now.
What to take from it
This is a case where the data is seven years old and still useful to someone. Emails and names don't expire. Expect the odd phishing message that mentions a design tool or a subscription for the rest of the time you keep that address.
What to do if you were in it
- 1
Change your Canva password
Pick a new one that you don't use anywhere else. A password manager makes that painless.
- 2
Change it everywhere you reused it
If the old Canva password matches a password on another account, change that one first, starting with email and banking.
- 3
Turn on two-step verification
Use an authenticator app on Canva and on your email account. A leaked password alone then isn't enough to get in.
- 4
Be careful with messages that mention Canva
Phishing built from this data often uses a real name. Don't follow links in an email about your account. Open the app or type the address yourself.
- 5
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the Canva data breach?
Enter your email address on Have I Been Pwned. If it shows Canva, your account was in the data.
Were my passwords exposed?
HIBP says passwords were included as bcrypt hashes, not plain text, for users who signed up with a password. Strong, unique passwords are hard to crack from a hash. Weak ones aren't.
Was my card number stolen?
HIBP doesn't list payment data for this breach. One outlet claimed partial payment data was taken but no other source backed it up.
Should I change my password?
Yes, if you haven't since 2019, and change it on any other site where you used the same one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
