2026 Canva — Canny third-party / Salesforce access; enterprise contacts (KVKK: 424 TR orgs)
Data compromised
Per Canva: limited enterprise customer business contact details and contract information via Canny↔Salesforce. Platform accounts, passwords, designs, content stated not accessed. Türkiye KVKK reporting: 424 organizations — employee names, business emails, workplace locations, corporate phones; some order forms, DPAs, MSAs, invoices. Global person census unpublished.
Technical writeup
Verified Canva statements (Capital Brief Sep 21, 2026; KVKK coverage). Canny informed Canva on August 29 of unauthorized access; Canny’s Salesforce connection exposed limited enterprise sales/customer contact and contract data. Canva removed Canny access, notified customers; core product not breached. Türkiye Personal Data Protection Authority: 424 orgs/institutions notified with employee and corporate contact fields plus some business documents. Extortion group “The Seven Deadly Sins” later listed Canva on a leak site (actor claim; separate from Canva’s confirmed third-party scope). recordsAffected 0 (no global person census); companyConfirmed true.
Root cause
Unauthorized access to third-party feedback platform Canny connected to Canva Salesforce (Canva confirmation)
References
- https://www.capitalbrief.com/article/canva-enterprise-customer-data-exposed-in-third-party-breach-b926931e-7c1b-4c1e-9f55-a3354cb0a1ed/
- https://www.turkiyetoday.com/business/third-party-data-breach-linked-to-canva-affects-424-organizations-in-turkiye-3228330
- https://www.teiss.co.uk/news/canva-reports-data-breach-impacting-more-than-420-organisations-18202
- https://databreaches.net/2026/09/23/canva-hacked-via-vendors-salesforce-instance-other-customers-affected-as-well/