Canva listed on THE SEVEN DEADLY SINS leak site following alleged data breach

• Ransomware group: THE SEVEN DEADLY SINS
• Country: Australia
• Sector: Technology
• Announcement date: October 16, 2026

Ransomware group claims breach of Canva

The threat actor group known as THE SEVEN DEADLY SINS has officially listed the Australian technology company Canva on its leak site. According to the announcement made on October 16, 2026, the group claims to have successfully exfiltrated data belonging to the organization. To exert pressure on the company, the group has shared a sample file as proof of the alleged breach.

The announcement suggests a significant scale of data loss, with claims that over 200 million rows of data have been compromised. This type of public listing is a common tactic used by ransomware groups to increase pressure on their victims during negotiations. By publishing a sample of the stolen information, the attackers aim to demonstrate the validity of their claims and damage the reputation of the targeted entity.

Details of the alleged exfiltration

The threat actor group alleges that it gained unauthorized access to critical components of Canva's digital infrastructure. Specifically, the group claims to have accessed the company's Salesforce organization and its platform data warehouse. This indicates a targeted effort to access sensitive business and customer information stored within these integrated systems.

The information identified in the leak includes several categories of sensitive data. According to the group's announcement and provided screenshots, the following data types are allegedly involved:

• Salesforce CRM records
• Enterprise license information
• Order PDFs
• Platform data warehouse data

The scale of the breach is highlighted by the claim that more than 200 million rows of data were taken from these sources. While the specific size of the total data volume and the exact file count have not been disclosed by the group, the sheer number of rows suggests a massive impact on the organization's data repository.

About Canva

Canva is an online graphic design platform that allows users to create social media graphics, presentations, posters, and other visual content. Based in Australia, the company aims to make professional design tools accessible to everyone through its drag-and-drop interface.

Potential impacts and security implications

This incident may create negative impacts on Canva's operational continuity and customer trust. The allegedly compromised CRM records could lead to secondary risks such as identity theft or targeted phishing attacks for the organization's customers and partners. Furthermore, as an Australia-based organization, a potential data breach may trigger legal processes under the Australian Privacy Act.

The group's tactics appear to follow the pattern of double extortion. In a double extortion scheme, attackers not only encrypt the victim's systems to disrupt operations but also steal sensitive data to use as leverage. The threat of leaking this data on a public site is used to coerce the organization into paying a ransom. This method is increasingly common in the modern threat landscape, making data exfiltration a primary goal for many ransomware operators.

Information regarding THE SEVEN DEADLY SINS remains limited; therefore, a definitive assessment of the group's motivation and past activities cannot be made at this time. Given the nature of the threat, organizations in the technology sector may need to re-evaluate their data privacy and cybersecurity measures to defend against such sophisticated exfiltration techniques. Common defensive strategies often include implementing strict access controls on CRM systems, enhancing monitoring of data warehouse exports, and ensuring robust encryption for sensitive files like order PDFs.