Canva, the Australian graphic design platform used by hundreds of millions of people worldwide, suffered a data breach in May 2019 when the hacker group GnosticPlayers, responsible for stealing data from dozens of companies totaling nearly a billion records, successfully accessed Canva's systems. Canva detected the intrusion while it was still underway and shut down the compromised server, limiting exposure to data created before May 17, 2019. Approximately 137 to 139 million user accounts were affected. The exposed data included email addresses, usernames, full names, and geographic locations. Around 61 million accounts also had password hashes stolen. Canva stored these passwords using bcrypt, a hashing method that is significantly harder to crack than older formats, but by January 2020 the attacker had cracked roughly 4 million of those hashes. Google OAuth tokens, used by people who logged into Canva via their Google account, were also exposed. No payment information was compromised. The practical risks include targeted phishing attacks, credential stuffing against other services where users reused the same password, and potential brand impersonation using personal details gleaned from the breach. Canva notified affected users the same day the breach was discovered and prompted password resets. In January 2020, after learning that 4 million hashed passwords had been cracked, Canva forced a password reset for all accounts that had not already updated their credentials. No regulatory enforcement action or legal settlement specific to this breach has been publicly documented. People affected by this breach should ensure they are not reusing the exposed password on any other service and should remain alert to phishing emails that may reference their Canva account.

Design platforms collect user accounts, emails, passwords, and created content, often tied to business or personal projects.

Canva has continued its rapid global expansion and has invested heavily in AI-powered design features, including generative image tools and automated design suggestions. The company has pursued enterprise market growth alongside its consumer and small business base. It has made several acquisitions to expand its capabilities including presentation and document creation tools.