Canva Data Breach (2019): What Was Exposed & What To Do

In May 2019, Canva reported a data breach that affected 137 million user accounts. The exposed information included email addresses, usernames, names, cities of residence, and passwords stored as bcrypt hashes for users who did not rely on social logins. The scale of the incident places it among the larger recorded compromises of consumer-facing online services. Public reporting at the time centered on the volume of records and the specific data elements involved, without further technical details released by the company.

Inside the incident

Canva stated on May 24, 2019, that an unauthorized party had obtained access to a portion of its user database. The company confirmed that 137 million accounts were involved. The data elements listed in public statements were email addresses, usernames, names, cities of residence, and bcrypt-hashed passwords belonging to users who had not authenticated through social-login providers.

No additional information on the method of access, the duration of the intrusion, or any subsequent activity by the actor has been disclosed in official statements. The company did not publish a detailed timeline or technical post-mortem beyond the initial notification.

How a breach like this happens

Incidents involving large user databases commonly begin with an attacker obtaining credentials or exploiting a vulnerability that grants access to internal systems. Once inside, the actor can query or export tables that store account information. Passwords are frequently targeted because they can be subjected to offline cracking attempts even when stored as hashes.

Organizations that maintain millions of accounts must secure both the application layer and the underlying data stores. When those controls are bypassed, the resulting dataset can contain the same categories of personal identifiers and authentication material seen in the Canva case.

Canva and its sector

Canva operates an online graphic-design platform used by individuals and organizations to create visual content. Like other services in the creative-software category, it requires users to create accounts that store contact details, geographic information, and login credentials.

Platforms of this type accumulate large volumes of user records because their business model depends on widespread adoption. A compromise at one such service therefore exposes data that can be cross-referenced with records from unrelated sites, increasing the overall risk surface for affected individuals.

What data was at risk

The breach notification identified five categories of information: email addresses, usernames, names, cities of residence, and passwords stored as bcrypt hashes. The hashes applied only to accounts that had not used social-login options.

Exact details on whether additional fields were present in the accessed tables have not been released. Organizations in this sector routinely hold further data such as payment information or usage logs, but those elements were not named in the public summary of this incident.

What's at stake

Exposed email addresses and names can be used for targeted phishing or account-recovery attacks on other services. Cities of residence add a modest amount of location context that may assist in social-engineering attempts.

Bcrypt-hashed passwords require computational effort to attempt reversal, yet any user who reused the same password elsewhere faces a risk of credential-stuffing attacks if the hash is eventually cracked. The organization itself faces regulatory scrutiny and the operational cost of notifying users and strengthening controls.

What to do if you're exposed

Individuals should change the password on their Canva account and on any other service where the same password was used. Enabling multi-factor authentication on important accounts reduces the chance that a leaked password alone will allow unauthorized access.

Users can also run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other incidents. Monitoring incoming email for unusual login alerts or password-reset requests provides an early indicator of attempted misuse.

AICompiled with AI assistance from public sources and published under our editorial standards.