Canva Breach Exposes 137M User Accounts and Password Hashes
What Happened — In May 2019 the graphic‑design platform Canva suffered a data breach that compromised 137,272,116 user accounts. The exposed data set includes email addresses, usernames, full names, city locations and password hashes stored with bcrypt for users who did not use social‑login authentication.
Why It Matters for Trust & Control Assurance —
- Highlights the risk of inadequate credential protection and the need for strong access‑control policies.
- Demonstrates why continuous monitoring of privileged data access and immutable audit logs are essential for defensible evidence.
- Aligns with the control objective of Secure Credential Management, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected — SaaS providers, design and marketing teams, education institutions, and any organization that integrates Canva into its workflow.
Recommended Actions — Review password storage mechanisms, enforce multi‑factor authentication, rotate compromised credentials, and implement continuous monitoring of access to user data. Collect evidence of these controls for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/Canva
Technical Notes — Attack vector not publicly disclosed; data types exposed were email, username, name, city, and bcrypt‑hashed passwords. Source: https://haveibeenpwned.com/api/v3/breach/Canva