An alleged dataset linked to design platform Canva has surfaced online, reportedly containing around 900,000 user records. At this stage, this is an unverified claim, and Canva has not confirmed a new breach. But the detail of what’s been shared is raising questions about how user data could be exposed, and what that might mean for those affected.
So what’s actually been reported, and how concerned should users be?
What has been reported so far
According to threat intelligence sources, a user going by the name “xorcat” has uploaded a database allegedly taken from Canva.
The dataset is said to include:
- Email addresses and full names
- User IDs
- Passwords (hashed)
- Sign-in methods
- Account activity data
- Platform usage details.
The file has reportedly been shared publicly on a forum, meaning it could be accessed and downloaded by others.
However, without independent verification, it’s not yet clear:
- Whether the data is genuine
- How old the dataset might be
- Or how it was obtained.
In this case, the passwords are said to be protected using bcrypt, which is a strong hashing method designed to make cracking difficult. But that doesn’t eliminate risk entirely.
Is this linked to the 2019 Canva breach?
Canva previously confirmed a major data breach in 2019, which affected around 137 million users. That incident involved exposed email addresses, usernames, and some encrypted passwords.
This newly reported dataset appears to be:
- Much smaller (around 900,000 records)
- Structured differently
- Potentially from a different source or time period
At this stage, there’s no confirmed link between the two.
What Canva users should do now
Even though this leak is unconfirmed, it’s a good reminder to review your account security — particularly if you use Canva regularly.
A few practical steps:
- Change your password (especially if reused elsewhere)
- Enable two-factor authentication (2FA) if available
- Be cautious of unexpected emails, particularly those asking you to log in
- Check connected accounts, such as Google or Facebook logins.
These are sensible steps regardless of whether this specific dataset turns out to be genuine.
We are keeping an eye on developments and will provide updates on this alleged breach if needed.
Join the Claim connects consumers with SRA-regulated lawyers. Keep an eye out for updates on any potential claim and possible eligibility checks/registration opportunities.
