Australian technology company Canva confirmed it was responding to a cyber security incident involving one of its third-party reporting tools today, after being recently listed by a ransomware actor.
Canva said its systems and operations were secure and unaffected, but some Salesforce data was nonetheless compromised.
The hacker – a new group calling itself Seven Deadly Sins – claimed to have more than two million lines of customer data. Cyber Daily, however, has been unable to verify that claim, and the data has now been sold to a “private buyer”.
Regardless, according to Kash Sharma, cyber security firm BlueVoyant's Managing Director for the APAC region, the incident is “a textbook case of how risk travels through the supply chain”.
“The exposure came through a third-party feedback tool with a standing connection into its Salesforce environment. That's the uncomfortable reality for most organisations. Your risk profile isn't just your vendors; it's every tool your teams and suppliers have plugged into your core systems,” Sharma told Cyber Daily.
“Few businesses have a current map of which third-party apps hold persistent access to their CRM, and fewer can say within hours whether a breach touches them.”
The hackers also claimed the compromised dataset contained many purchase orders, which could potentially expose Canva’s customers further. The risk now, Sharma contends, “is what comes next?”.
“With genuine order and billing documents reportedly in criminal hands, attackers can craft invoice and renewal scams that look entirely legitimate,” Sharma said.
“Finance and procurement teams should verify any payment or billing request through a known, separate channel, and treat urgency as a red flag.”
The key to securing supply chain risk is visibility, Sharma said – companies absolutely needto know which apps are connected to their systems, and what data they each hold or have access to as a basic security necessity.
“Keep checking them throughout the year rather than relying on annual questionnaires,” Sharma said.
“Organisations with that picture can work out quickly whether they're exposed, while those without it are left piecing it together as the news unfolds."
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
