Canva Hacked? 2019 Breach vs 2026 Canvas Hack: What to Do

Updated 23 October 2026

Yes, Canva was hacked in 2019. Its confirmed data breach was disclosed on 24 May 2019, exposed about 137 million user accounts, and is listed on Have I Been Pwned. Google's first page shows no confirmed new Canva breach since then. The 2026 headlines about schools being disrupted are about Canvas, a learning platform run by Instructure. That is a different company and a different product.

Was Canva hacked? The short answer

If you had a Canva account before mid-2019, check your email address and change any password you reused on other sites. If you are a student, parent or teacher, the 2026 news is about Canvas, and the next section explains what is known.

Here is the difference at a glance, so you can see which breach you are looking for.

Canva and Canvas are different products. Check which breach applies to you.

Canva or Canvas? Why the search got mixed up

Canva and Canvas are one letter apart, and that letter caused a lot of confusion in 2026. One is a design app used by millions of people. The other is the system many schools and universities use for classes, homework and grades.

What 135,000 monthly searches tell us

Searches spiked in May 2026, the month of the Canvas breach news. US searches for "canva hacked" ran at 2,900 to 5,400 a month between October 2025 and April 2026. In May 2026, when searches spiked, they jumped to 1,500,000. By September 2026 they were back to 9,900 (DataForSEO, October 2026).

Month	US searches for "canva hacked"
October 2025	3,600
November 2025	5,400
December 2025	4,400
January 2026	3,600
February 2026	4,400
March 2026	2,900
April 2026	2,900
May 2026	1,500,000
June 2026	9,900
July 2026	5,400
August 2026	9,900
September 2026	9,900

Source: DataForSEO, October 2026.

The 135,000 monthly average is pulled up by that one month. Leave May out and the other 11 months add up to 62,300 searches, which averages about 5,700 a month. That gap suggests most of May's searchers were looking for Canvas and typed one letter short.

Canvas hacked in 2026: what the first page reports

Yes, Canvas was hacked in 2026. Wikipedia has a page called "2026 Canvas data breach", and CNN and YouTube reports describe schools across the US being disrupted. Inside Higher Ed reports that Instructure paid a ransom to the Canvas hackers, and Cybersecurity Ventures covered the attack in a piece dated 7 July.

The people affected, as the first page describes them, are students, parents and faculty at schools that use Canvas. StaySafeOnline's guidance is written for exactly those three groups. For what data was exposed, Wikipedia's "Impact" section and CNN's "What we know about the Canvas hack" report set out the current details, and a Reddit thread asking how much personal information will leak shows that personal data is the main worry. What was exposed can differ from school to school, so your school's own notice is the best guide to your data.

What Canvas users can do now:

• Expect phishing emails and texts that mention Canvas or the breach.
• Do not click login links in those messages. Type your school's Canvas address yourself.
• Change your Canvas password if your school asks you to.
• Reuse nothing. Your Canvas password should not open any other account.

Which schools were affected by the Canvas hack?

People search for a "Canva hacked school list", but we will not publish a list of names we cannot confirm. Wikipedia's "Impact" section on the 2026 Canvas data breach page is the closest thing to a public list on the first page. Your school's emails, website and Canvas announcements will say whether it was affected and what to do.

Where to find the latest Canvas hack update

Details change as investigations go on. If you are searching for a Canvas hack update, or "Canvas hacked September 2026", read Instructure's own notices, your school's messages and the Wikipedia page for the current picture. We will update this page as the first page changes.

What happened in the 2019 Canva breach

Canva disclosed the incident on 24 May 2019. Its Help Center still hosts the "Canva Security Incident - May 24 FAQs" page, which is the primary source to read.

What data was exposed

As commonly reported and listed by Have I Been Pwned, the breach exposed names, usernames, email addresses and cities. Passwords for some users were also taken, stored hashed rather than in plain text.

A hashed password is scrambled one way, so attackers cannot simply read it. Weak or common passwords can still be guessed, though, by hashing millions of likely passwords and looking for matches. That is why changing a reused password still matters years later.

What was not exposed

Because the passwords were hashed, readable passwords were not in the leak. Not every account had a password included either, since the reports say passwords were taken for some users only.

The bigger lesson is about reuse. A 2019 email and password pair can still turn up today in credential-stuffing attacks, where criminals try leaked logins on other sites. If you used your old Canva password anywhere else, that account is the one at risk.

Was Canva hacked in 2021?

Google's first page shows no confirmed Canva breach in 2021. The Canva incident on the first page is the 2019 one. To see every breach your email address appears in, by name and year, search it on Have I Been Pwned.

Is it safe to use Canva right now?

As of 23 October 2026, the first page of Google for this search shows no confirmed new Canva breach. The Canva result on page one is the 2019 incident FAQ.

Safe to use does not mean nothing to do. Run through this quick checklist:

• Password: unique to Canva and at least 16 characters.
• Two-step login: turned on.
• Connected apps: only ones you still use.
• Sharing: no private designs left on "anyone with the link".

Be careful with "Canva hacked" posts on Reddit and social media. Many are about one person's account being taken over, often through a reused password, and not a company breach.

How to check if your Canva data was exposed

Check your email address

Enter every email you have used with Canva into our free email leak checker and into Have I Been Pwned. If your address was in the 2019 breach, it shows up there by name.

Check for reused passwords

If you see the Canva breach, list every other site where you used the same password. Those accounts are the real risk now, so change those passwords first.

Then test your current Canva password with our password strength tool before you decide to keep it. If it is short, common or used anywhere else, replace it.

How to secure your Canva account in 15 minutes

Six steps, about 15 minutes.

Change your password

Create a new, unique password of at least 16 characters with our password generator. Save it in a password manager so you never need to remember or reuse it.

Turn on two-step verification

Turn on two-step verification in your Canva account's login and security settings. After that, a stolen password alone is not enough to get in, because a second code is needed too.

Sign out of other devices

Sign out of all other sessions. Any old phone, shared computer or forgotten browser that was still logged in loses access straight away.

Remove connected apps you no longer use

Review the apps and integrations linked to your Canva account. Remove any you do not recognise or no longer use, because each connected app is one more door into your designs.

Secure your Google, Facebook or Apple login

If you sign in to Canva with Google, Facebook or Apple, that account is now the key to Canva. Give it a unique password and two-step verification as well.

Watch for Canva phishing

Scammers use Canva's name in fake "someone shared a design with you" emails. Open Canva directly and look for the design there instead of clicking the link. The same habits help with other tools, as our guide to check if your AI account was hacked explains.

Your designs and shared links: the leak most people forget

A strong password protects your login. It does not protect a design you have already shared with the world.

Links shared with anyone who has them

A design shared as "anyone with the link can view" can be opened by anyone the link reaches. That includes a forwarded email, a group chat or a public post. No hack is needed.

Client and personal data inside designs

Look at what sits in your designs. Invoices, client names and phone numbers, event guest lists, school rosters, ID photos and draft contracts are common. If a design holds images you care about, our guide to protect your photos from hackers covers the wider steps.

Team members and old collaborators

Photo by Mikhail Nilov on Pexels Freelancers and small businesses build up access over time. Remove ex-clients and ex-staff from teams and shared folders, and switch old links to restricted access. Our guide to staying safe while working remotely has more on shared work tools.

Run this audit once now and again whenever a project ends.

Recent hacks and how to keep up

What has been hacked recently?

The biggest recent example on this search's first page is the 2026 Canvas data breach that disrupted schools. We have also covered the Revolut data breach 2026 and the Cash App data breach settlement, with steps for each.

How to check which company was hacked today

No single site lists every company hacked today. A practical method works better:

1. Sign up for breach alerts on Have I Been Pwned for each email you use.
2. Run your addresses through our email leak checker after any big news.
3. Read the company's own notice before trusting a social media post.

You can also shrink the damage of the next breach. Old accounts you forgot about still hold your data, so find and delete old online accounts you no longer use.

Where a VPN helps, and where it does not

To be honest first: no VPN can stop a company like Canva or Instructure being breached. Your password, two-step login and sharing settings matter most.

Photo by Kevin Paster on Pexels Where a VPN does help is on networks you do not control. On school, café and hotel Wi-Fi it encrypts your connection so others on the network cannot see what you do, and it hides your IP address from the sites you visit. You can read more about everyday ways people use a VPN.

GhostShield VPN uses WireGuard with ChaCha20-Poly1305, with a kill switch and DNS leak protection. Ad and malware blocking and AI threat detection are included, and a strict no-logs policy means your browsing activity is not stored on our servers. You can use it on up to 10 devices at once across Windows, macOS, Android, iPhone and iPad and Google TV.

GhostShield VPN app on a MacBook See the plans on our pricing page. Every plan starts with a 7-day free trial and there is a 30-day money-back guarantee, so you can start your 7-day free trial and see how it fits your day.

FAQ

Did Canva have a data breach?

Yes. Canva's confirmed data breach was disclosed on 24 May 2019 and exposed about 137 million accounts, including names, usernames, email addresses, cities and hashed passwords for some users. Google's first page shows no confirmed newer breach. Check your email on Have I Been Pwned and change any password you reused elsewhere.

Is it safe to use Canva right now?

Yes, as of 23 October 2026 Google's first page shows no confirmed new Canva breach. Your own settings matter more: use a unique password, turn on two-step verification, remove old connected apps and restrict designs shared with "anyone with the link".

Has Canvas been hacked yet?

Yes, Canvas, the school learning platform run by Instructure, was hacked in 2026. Reports describe schools across the US being disrupted, and Inside Higher Ed reports Instructure paid a ransom. Follow your school's notices, watch for phishing that mentions Canvas and never reuse your Canvas password.

Who is the #1 hacker?

There is no official number one hacker, and any ranking you read is opinion. Kevin Mitnick is the name that appears most often on such lists. For your own safety, the hackers that matter are the ones trying leaked passwords, so keep yours unique.

Who is the world's most famous hacker?

Kevin Mitnick is the name most often given as the world's most famous hacker. He was once wanted by the FBI, later worked in security helping companies defend themselves, and died in 2023. Much of his work showed how often people, not systems, are the weak point.

Who is the youngest hacker?

The case most often cited is Kristoffer von Hassel, who at 5 years old in 2014 found a login flaw in Xbox Live. Microsoft credited him for reporting it. His story shows that simple login weaknesses exist, which is why two-step verification is worth turning on.

Can a hacker go to jail?

Yes, hackers can go to jail. In the US, unauthorised access to computers is a federal crime under the Computer Fraud and Abuse Act, and convictions can bring prison time and fines. Legal risk does not stop every attacker, so protect your accounts with unique passwords and two-step login.