Canva — Third-party compromise disclosed October 2026

New incident
Third-party compromise
Reported

What this record states

Canva has reported a data breach through a platform operated by a third party.

The source states that information about customers was involved.

No source consulted for this record states when the incident occurred.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: 19 October 2026
Notification date: Not confirmed
People affected: Not stated
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

Not stated

Law enforcement notified

Not stated

Legal and formal response

Not stated

Technical and organisational remediation

Not stated

Official sources

Corroborating report

Exclusive: Aussie software giant Canva confirms third-party data incident - Cyber Daily

cyberdaily.auRetrieved 20 October 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record identifies a third-party data incident involving Canva, publicly disclosed on 19 October 2026. It does not publicly establish the incident date, discovery date, notification date, number of affected people, data categories, or the regulatory and legal response. Customers are identified as the affected group.

The supporting material refers to earlier Canva breaches in 2019 and 2020 in which tens of millions of users’ real names, usernames and passwords were exposed, but it does not establish that those details describe this incident. The record states that Canny’s access was immediately removed and that affected customers were informed where required, but provides no further verified detail about the third-party compromise or remediation.

How Cleverer may have helped

For this kind of third-party failure, preparation and oversight may help an organisation define access controls, supplier responsibilities, escalation routes and notification processes. Maintaining current evidence of reviews, decisions, access removal, communications and cooperation with relevant agencies could make it easier to establish what occurred and demonstrate how obligations were considered.

Such records would not by themselves establish that controls were effective or that the incident was necessarily preventable. None of this would necessarily have prevented the incident, a regulatory finding or any resulting consequence.