Loading story…
Canva disclosed that attackers accessed data through a compromised connection involving Canny, a product-feedback vendor and data processor, affecting information associated with 424 organizations and institutions in Türkiye. The intrusion reached Canny’s environment and data available through its connection to Canva’s customer-relationship tool; Canva said its own platform was not compromised and that user accounts, passwords, designs, and other user content remain secure. The company revoked Canny’s access, notified affected customers and regulators where required, and Türkiye’s Personal Data Protection Board (KVKK) is investigating; the number of affected individuals has not been disclosed.
The extortion group calling itself The Seven Deadly Sins (TSDS) claimed it accessed Canva through Canny’s Salesforce integration beginning in late August, obtained administrative access, and exported data before making a ransom demand. TSDS alleged the theft included more than 2 million Salesforce CRM records and over 200 million data-warehouse rows, including enterprise orders, contracts, customer and billing records, and PDFs, while also claiming compromises of other SaaS environments. Those claims, including the asserted scale and scope of stolen data, remain unverified.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
TSDS claimed it sent Canva a ransom demand on August 28 after allegedly extracting data from the company's accessible Salesforce and data-warehouse environments. A TSDS spokesperson separately told DataBreaches that the group attacked Canva on that date, although the claims were unverified.
The Seven Deadly Sins (TSDS) claimed it compromised Canva feedback vendor Canny beginning on August 26 and used its integration to obtain administrator access to Canva's Salesforce environment. TSDS alleged it remained in the environment for more than 72 hours and exported Salesforce and product-data records; these claims were not independently verified.
Canva removed Canny's access following the incident and said it notified affected customers and regulators where required. Türkiye's Personal Data Protection Authority was notified, and the Personal Data Protection Board opened an investigation.
Canva disclosed that attackers exploited a compromised connection involving a Canny data processor and extracted data accessible through Canny's connection to Canva's customer-relationship tool. The company said the incident potentially affected information associated with 424 organizations and institutions in Türkiye, while its own platform, user accounts, passwords, designs, and other user content were not compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Instructure, the company behind the Canvas learning management system, disclosed that a criminal threat actor breached its environment and stole user data from affected educational institutions. The company said the exposed information included **names, email addresses, student ID numbers, course and enrollment details, and messages between users**, while it found no evidence that passwords, dates of birth, government identifiers, financial information, course content, or student submissions were compromised. Reporting tied the intrusion to the **ShinyHunters** extortion group, which claimed far broader impact—up to **3.65 TB** of data and roughly **275 million records** across nearly **9,000 schools**—though those figures were not independently verified. Instructure said the attackers exploited flaws in its **Free-for-Teacher** environment, brought in outside forensic experts, notified law enforcement, revoked privileged credentials and access tokens, rotated keys, patched systems, and required some customers to reauthorize API access. The incident escalated when attackers allegedly reused the same access path to deface Canvas login portals with ransom messages, prompting Instructure to temporarily take Canvas offline and suspend Free-for-Teacher accounts while it contained the activity. The outage disrupted universities and schools across the U.S., Canada, Australia, Europe, and Asia during final exams, forcing some institutions to postpone tests, extend deadlines, or block access as a precaution. Instructure later said it reached an agreement with the threat actor under which the stolen data was returned and deletion was purportedly confirmed, but the company acknowledged there is no guarantee criminals actually destroyed their copies. The breach has since triggered warnings about follow-on phishing and impersonation campaigns, lawsuits, and scrutiny from the **U.S. House Homeland Security Committee** over how the same platform was compromised twice in quick succession.
Jun 29, 2026
ShinyHunters has claimed responsibility for breaching Cisco and stealing more than **3 million Salesforce records** along with internal corporate data, **GitHub repositories**, and contents from **AWS S3 buckets**, then posted a **"FINAL WARNING"** on its leak site threatening to publish the data after April 3. Reports said the alleged haul may include information tied to Cisco customers, employees, and personnel from U.S. and foreign government agencies, while screenshots shared by the group purportedly showed access to Cisco-linked AWS infrastructure and multiple connected cloud accounts. The intrusion was linked in reporting to three alleged access paths involving **Salesforce CRM**, **Salesforce Aura/Experience Cloud**, and AWS environments, and to activity tracked as **`UNC6040`** and **`UNC6395`**. Threat intelligence cited in the coverage said the attackers have used **vishing** to trick employees into approving malicious Salesforce OAuth applications, then abused stolen tokens to bypass MFA and move deeper into cloud environments; recommended defenses included auditing connected OAuth apps, revoking suspicious tokens, tightening API access controls, and monitoring for unauthorized Salesforce Data Loader activity. Cisco had not publicly addressed the March 2026 extortion claim at the time of reporting.
Jun 29, 2026
Instructure disclosed a major breach of its **Canvas** learning management system after the **ShinyHunters** group allegedly exploited a vulnerability in the platform’s **Free-For-Teacher** account program on April 30, 2026. The attackers claimed to have stolen data on **275 million individuals**, including student, faculty, and staff information and private messages between students and teachers, with reports estimating about **3.65 TB** of exfiltrated data. The incident was reported to affect thousands of institutions worldwide, with cited impact ranging from **8,809** to roughly **15,000** schools and organizations across the U.S., Europe, and the U.K. After Instructure initially chose to patch systems rather than negotiate, ShinyHunters escalated the campaign by **defacing Canvas login portals** and disrupting final examinations at multiple universities when a ransom deadline approached. Instructure later suspended the Canvas portal during the fallout, and subsequent reporting said the company paid a ransom after receiving digital confirmation that the stolen data had been destroyed and that customers would not face further extortion. The operation was characterized as a **pay-or-leak extortion campaign** that abused account access, application-layer weaknesses, and platform or API functionality rather than deploying malware or encrypting systems.
Jul 7, 2026