Canva hacked and personal information got compromised

Canva - the Australian tech unicorn - was hacked, with data of around 139 million users got stolen. Canva is one of the most noticeable technology companies of Australia, and has also been recognized as one of the best workplaces of the nation. On May 25, 2019, Canva notified its users about the attack, saying that it was made aware about it just a day before.

In a statement, Canva said that "on 24 May, we became aware of a security incident. As soon as we were notified, we immediately took steps to identify and remedy the cause, and have reported the situation to authorities (including the FBI)".

The personal information that was compromised included customer's real names, usernames, email addresses, as well as country and city information. Credit card details or other types of financial information have not been taken; whereas the passwords that have been accessed remains encrypted, thus making them unreadable for the external parties, said Canva.

News site ZDNet has revealed first about the attack after getting tipped off by hacker, called as GnosticPlayers. This high-profile hacker is famous for selling the obtained data on dark web. The hacker claims that they have downloaded the user information till May 17, 2019, with the breach getting detected on May 24, 2019, and then the database server was closed by Canva.

Around 61 million users have their password hashes taken, however they remain encrypted using bcrypt algorithm, which is considered as one of most secure. As a precautionary step, Canva is still recommending all their users to change the passwords.

Canva's FAQ for this incident reassures the users that "there have been no indications that any user designs have been accessed". As per the FAQ on their website, Canva said that "we are working with a forensics team that specialises in these types of attacks and the FBI to diagnose exactly what happened and are putting processes in place to help prevent another attack".

Canva also said that they were committed to protect the privacy and data of all their users, and thus will implement every possible safeguard to make sure that this does not take place again.

» SPAMfighter News - 6/15/2019