Australian software multinational Canva has disclosed that “some enterprise customer records” were recently exposed during a cyber security incident impacting one of its third-party data tools after hackers claimed to have breached the company and sold stolen data online.
The Seven Deadly Sins ransomware group listed Canva in an October 16 post to its darknet leak site.
According to the hackers, the allegedly compromised data included more than two million Salesforce records, enterprise license orders, and billing PDFs. One sample document was published as evidence of the hack, which appears to be a legitimate order form for Canva for Enterprise.
If the hackers are to be believed, the data has already been sold to a “private buyer”.
A Canva spokesperson explained that the incident impacted Canny, “a third-party tool Canva used to collect product feedback”.
“The unauthorised access to Canny allowed access to some enterprise customer records through its connection to Canva’s Salesforce account, including business contact details and routine business documentation,” the spokesperson told Cyber Daily.
“We immediately removed Canny’s access, informed affected customers where required, and have complied with our obligations and collaborated with relevant agencies in the best interest of our community.
“Canva’s own platform and systems were not compromised, and Canva accounts, passwords, designs and content remain secure.”
Who is Seven Deadly Sins
This new ransomware group is one of around a dozen threat actors to emerge this year, having claimed its first in late September.
Since then, Seven Deadly Sins has claimed a total of eight victims. Otherwise, very little is known about the group, whose Latin motto translates as "Not for ourselves, but for common security."
Who is Canva?
Canva is one of Australia’s most prominent technology companies, having made its name with its free graphic design platform of the same name.
The company has more than 265 million monthly active users, employs roughly 5,500 individuals, and boasts offices across Australia and the world.
Canva’s partners include Netflix, the Warner Music Group, and YouTube.
The company suffered data breaches in 2019 and 2020 that saw tens of millions of users compromised, with their real names, usernames, and passwords exposed. Canva responded to the 2020 incident by resetting the passwords of every user who had not changed their password since the initial breach in January of that year.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
