Canva Confirms Third-Party Canny Breach Exposed Enterprise Salesforce Records

Australian software company Canva has disclosed that some enterprise customer records were exposed after unauthorized access hit Canny, a third-party product feedback tool connected to Canva's Salesforce account. The Seven Deadly Sins ransomware group claimed the breach in an October 16 post on its darknet leak site, alleging the compromised data includes more than 2M Salesforce records, enterprise license orders, and billing PDFs. The group published one sample document appearing to be a Canva for Enterprise order form and claimed the stolen data has already been sold to an unidentified private buyer. Canva stated that the exposed records included business contact details and routine business documentation, adding that it immediately revoked Canny's access, notified affected customers where required, and confirmed its core platform, passwords, and user designs remain secure. "The unauthorised access to Canny allowed access to some enterprise customer records through its connection to Canva’s Salesforce account, including business contact details and routine business documentation." — Canva Spokesman