Cryptographically protected using the bcrypt algorithm.
The leak did not happen all at once. It evolved in stages over several months and years: Canva.com database leaked 24th May 2019.7z
Canva collaborated with the and cybersecurity firm Mandiant to investigate and remediate the incident. Their response included: Canva Security Incident – May 24 FAQs - Canva Help Centre Cryptographically protected using the bcrypt algorithm
Canva discovered that a list of 4 million decrypted passwords from the original breach had been shared online. Their response included: Canva Security Incident – May
The initial database intrusion occurred. Canva interrupted the attack mid-way and locked down their systems.
The May 24, 2019, Canva data breach is one of the largest in history, affecting approximately . The incident was carried out by a hacker known as GnosticPlayers , who targeted the platform's profile database. While the breach occurred in 2019, its impact has continued for years, with millions of passwords later decrypted and shared online as recently as late 2024. Overview of the Breach Discovery Date: May 24, 2019.