Breach Disclosure: Canva

Canva, the stylish simple-to-use website tool for design, suffered a breach that exposed 139 million records according to their publication about the incident. This breach took place on May 24th, 2019. The breach consists of names, usernames, email addresses, country, city and bycript hashed passwords. The attackers reportedly were also able to view encrypted Oauth tokens, partial credit card data, and payment histories, but Canva has stated they have no evidence the attackers actually downloaded this data and the financial information was not complete enough to be used for payments.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

Canva is an online tool for web and graphic content using a drag-and-drop approach. This website is used by non-designers and professionals with the intention of building stylish designs with their free and paid pro versions that suggest premade canvases. The authentication to this websites offers the ability to use Google and Facebook authentication tokens, and users signing up for the site must provide name, country, username and email.

According to the official publication of Canva, it’s possible that the attackers had access to not only the personal identifiable information of their 139 million registered users, but also files containing credit card details--including name, expiry date, last 4 digits, card brand and card country--from before September 28th, 2016, and payment histories from before September 16th, 2017 that contained transaction dollar amounts, dates, and IDs for some payments for users and contributors. Canva has stated that none of this financial information can be used for payments.

Canva is currently contacting notifying their affected users to change their passwords and be aware of potentially suspicious emails. Also, on their side, they are resetting the auth tokens for the entire platform, so users will have to authenticate again to continue using Canva. They are also offering one year of free service with a password manager.