Canva Pty Ltd

Companies / web services

Aliases / services: キャンバ / Canva / Canva Pty Ltd
Official website: https://www.canva.com/

Sources identifying the operating company

https://www.canva.com/policies/terms-of-use/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Canva.com accounts

Response status: Not listed
Response information checked: 2026-10-29

Current re-audit: Related incident verified; PHP connection not stated · Research date: 2026-10-29

After the May 2019 breach, Canva confirmed in January 2020 that about four million passwords had been decrypted and shared. It invalidated passwords that had remained unchanged.

Scope: A PHP connection and response to the current PHP vulnerabilities are not listed.

What users should do

If still using the affected password, change it on Canva and any reused accounts, using unique passwords. Do not reply to suspicious emails; use official account-recovery procedures.

Official service URL

https://www.canva.com/

Source URLs

24 May 2019 incident FAQ, January 2020 updatehttps://www.canva.com/help/incident-may24/Service and operation documentation

Related official sources

Official operator identityOfficial information directoryLegal name and operator checked.
24 May 2019 incident FAQ, January 2020 updateOfficial notice; link to this PHP incident unconfirmedVerifies the named service at the notice date; not evidence of remediation for the current PHP vulnerabilities.