Canva reports third-party breach affecting 424 organisations in Türkiye

Canva reported a breach at feedback platform Canny that may have exposed information linked to 424 organisations and institutions in Türkiye. Attackers used a compromised connection involving one of Canny's data processors to access and extract information from the affected system, according to the incident account. The exposed material included employee names, business contact details and, for some organisations, documents such as order forms, invoices and agreements. Canva said it removed Canny's access to its customer relationship tool and notified affected parties where required. The company said its own platform was not compromised and that user accounts, passwords and designs remain secure. Türkiye's data protection authority is investigating; the number of affected individuals is undetermined.