The Seven Deadly Sins claims attack on Canva after third-party breach already confirmed by the press
The Seven Deadly Sins group claims to have attacked Canva, the Australian online design platform. Several outlets had already reported in September 2026 a third-party breach that exposed enterprise customer data linked to more than 420 organisations, putting supply chain risk back in the spotlight.
What happened
On 15 October 2026, The Seven Deadly Sins listed Canva among its victims, according to the group itself. The Australia-based technology company had already been in the news over an earlier incident.
Between 18 and 23 September 2026, several outlets reported a breach linked to Canva. Daily Sabah and Türkiye Today reported on 18 September that the breach, which originated at a third party, affected data linked to 424 organisations in Türkiye. Capital Brief reported on 21 September that Canva enterprise customer data had been exposed in a third-party breach, and teiss noted on 23 September that Canva had reported a breach affecting more than 420 organisations.
The press therefore confirms that an incident took place. However, attribution to The Seven Deadly Sins rests solely on the group's own claim, published weeks after that coverage. The available information does not specify what type of data was compromised or whether any ransom was demanded.
Who is the group
The Seven Deadly Sins is a group that publishes claims of attacks. Verified information about its methods, tools or initial access techniques is limited. Because the claim surfaced after media coverage, caution is warranted until more evidence links the group to the breach described by the press.
What organisations can do
The incident mainly affects enterprise customers of a widely used SaaS platform, and its third-party origin shows that risk does not depend only on the security of the main provider.
- Check whether your organisation has received communications from Canva about the incident and follow its guidance.
- Take stock of the data and documents stored on the platform and who has access to them.
- Review single sign-on integrations and connected apps, and rotate credentials or tokens if in doubt.
- Enforce multi-factor authentication on all corporate cloud service accounts.
- Warn staff about phishing emails that may exploit the incident.
- Include rapid breach notification clauses in SaaS contracts, covering incidents at the provider's own third parties.
Sources
- Capital Brief: Canva enterprise customer data exposed in third-party breach
- teiss: News - Canva reports data breach impacting more than 420 organisations
- Daily Sabah: Canva breach affects data linked to 424 organizations in Türkiye
- Türkiye Today: Third-party data breach linked to Canva affects 424 organizations in Türkiye
About the group: The Seven Deadly Sins
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.