Canva — 137 Million Accounts, and Why "Passwords Exposed" Overstates It (2019)

What happened

In May 2019 the graphic design platform Canva was breached, affecting 137,272,116 subscribers. The exposed data comprised email addresses, usernames, names, cities of residence and — for users not signing in through a social login — passwords stored as bcrypt hashes. The seller GnosticPlayers claimed responsibility and listed the data among the 2019 Dream Market batches.

The label that was wrong, and why we know

The HIBP catalogue records a data class called Passwords for this breach. That class means a password field was present in the dump. It says nothing about how the password was stored.

GalaxyWarden got this wrong once, publicly. Our own regression suite (tests/test_breach_record_count_is_derived.py) records the defect: a page rendered "Plaintext password leaked · Canva" from that data class. Canva's passwords were bcrypt. The label was false, and it was false in the direction that causes real harm — it tells a reader their password is public when it is not, which pushes them toward panic and away from the actions that would actually help.

There is a second layer here that automated pages routinely miss: a large share of Canva users had no password in the dataset at all, because they authenticated through Google or Facebook. For those accounts there was never a Canva password to leak, and "change your Canva password" is advice about something that does not exist.

What was actually at risk

Strip out the password panic and a real exposure remains: name, username, email address and city of residence, for 137 million people, many of them running small businesses, freelance design practices or social-media presences under a brand name.

City-level location paired with a real name and a working email address is a solid foundation for targeted fraud — particularly invoice and client-impersonation scams aimed at freelancers, who expect unsolicited mail from strangers and are professionally obliged to open it.

The identity-chain implication

Design-tool accounts sit at an awkward junction: registered under a real name for billing, used to produce work published under a brand or handle. The Canva dataset therefore links a legal name and a home city to a creative identity that may be deliberately separate from it.

For a creator whose brand is public but whose location is not, that is the entire distinction collapsing in one row — and no password change repairs it, because no password was involved.

What to do now