GnosticPlayers claims to have hacked graphic design service Canva and stolen names, usernames, email addresses of 139M users, and 61M strongly hashed passwords
Catalin Cimpanu / ZDNet : Tweets: @evolvable , @krishnan , and @campuscodi Tweets: Graham Lea / @evolvable : Ouch. Bit of a punch in the guts for Canva after their recent raise. Sounds like the hacker got very little of value, though - useless password hashes, no payment details or private info. Notch one up for defence in depth. 👍 https://twitter.com/... Krish Subramanian / @krishnan : If you use Canva for your graphics needs, looks like it has been hacked. Change your passwords/Google Authentication tokens Catalin Cimpanu / @campuscodi : Exclusive: Australian tech unicorn Canva suffers security breach.Hacker claims to have stolen the data of 139 million Canva users. Site is ranked #170 on Alexa.https://www.zdnet.com/ ... https://twitter.com/...
Context & Ripple Effects
GnosticPlayers' claim against Canva lands mid-wave in a run of consumer-platform breaches: months later Freepik disclosed a strikingly similar incident — usernames and password hashes of 8.3M users — and CafePress leaked 23M email addresses around the same period.
What makes this one a template case is what the attacker did and didn't get: no payment details or private info, and 61M passwords behind strong hashing — though the corpus shows hashed credentials don't always stay safe, as with Nvidia staff whose password hashes were later cracked and circulated.
First-order effects
- Canva's 139M users face immediate credential hygiene work — password resets and revoked Google authentication tokens, per Krish Subramanian's warning — while the company itself absorbs reputational damage right after its recent raise.
- Because payment details and private info were not exposed, Canva's direct financial exposure is limited to response costs and trust erosion rather than fraud liability.
Second-order effects
- The stolen email list becomes raw material for phishing and credential-stuffing elsewhere — the same dynamic seen when Mailchimp's breached audience data was quickly turned into crypto-user scams.
- Breach brokers like GnosticPlayers face weak resale economics on strongly hashed passwords, pushing stolen corpora toward free forum distribution instead — the path later taken by the hacker who dumped data from 18 companies including Dave and Wattpad at no charge.
Third-order effects
- If strong hashing keeps holding — as Canva's defenders argue and Nvidia's cracked Windows hashes show is not guaranteed — the market value of breach data shifts from passwords toward emails and profile data, which fuel cross-service attacks.
- The pattern points toward breach aggregation as a standing industry: individual incidents like Canva's, Freepik's, and CafePress's get consolidated into searchable dumps and notification services such as Have I Been Pwned, making single-company disclosures only the first stop for stolen data.
The trend: Consumer web platforms are becoming a continuous supply chain for breach-data markets, where strong hashing caps the damage per incident but email-scale user lists keep circulating through forums and aggregators.