Canva Data Breach: What Was Exposed and What to Do
Canva’s 2019 breach is an old one, but its data is still circulating. Here is what was in it and whether you need to act.
By Siddharth ShankarUpdated October 19, 2026In May 2019, Canva suffered a breach that affected about 137.3 million accounts, which Have I Been Pwned added in August 2019. Exposed data included email addresses, usernames, names, cities and passwords stored as bcrypt hashes, for users who did not sign in with a social login. If you used Canva before 2019, change any reused password, turn on two-step verification and watch for phishing that mentions Canva.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Canva is a popular design tool used by students, small businesses and teams. If you made an account years ago, your address may sit in the data from this breach.
What happened
According to Have I Been Pwned’s entry for Canva, the breach occurred in May 2019 and was added to the service on 9 August 2019. About 137.3 million email addresses were affected.
What data was exposed
- Email addresses
- Usernames
- Names
- Geographic locations, specifically cities of residence
- Passwords, stored as bcrypt hashes, only for users who did not sign in with a social login
What bcrypt hashes mean
A hash is a scrambled version of a password. Bcrypt is designed to be slow to crack, so a long, unique password is far harder to recover than one stored with older methods. A weak or common password is still at risk, because attackers can guess likely passwords against the hash. If you signed in with Google or Facebook, no password was stored for you in this data.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
Do you still need to worry?
The breach is old, but data does not expire. Names, cities and email addresses stay useful to scammers, and some people reuse old passwords. See should you worry about an old data breach.
What to do
1Check if you are in it
Run the free check on this page, or search your email at Have I Been Pwned.
2Change your Canva password
If you used the same password anywhere else, change it there too. A password manager makes unique passwords easy.
3Turn on two-step verification
Use it on Canva and, more importantly, on your email.
4Be careful with Canva emails
Fake sharing and design invitations are common phishing lures. Go to the site directly instead of clicking.
5Review linked sign-ins
If you use Google or Facebook to sign in, check which apps have access to those accounts.
Spotting Canva-themed phishing
Design tools are a popular lure because people expect sharing invitations. Be suspicious of messages that say a design has been shared with you but come from an unfamiliar sender, warn that your account will be suspended, or ask you to log in through a link to keep your designs. Check the sender’s address, do not enter your password through an email link and go to the website directly instead.
If your old password was a common one
A hash slows an attacker down, but it does not protect a password that is easy to guess. Common words, names and patterns such as a name followed by a year fall quickly. A passphrase of four or more unrelated words, or a long random password from a password manager, is far stronger.
What a city adds to the picture
The data included cities of residence. A name, an email address and a city let a scammer write a message that sounds local and personal. That is why even a breach with no card details is worth taking seriously. See what open-source research can find about you for how small details are combined.
What the data can be used for
A name, city and email address are enough to write a believable phishing email. They also help connect your accounts across sites. See what each type of breached data means, and what a combolist is to understand how old breaches get reused.
Sources
- Have I Been Pwned: Canva breach (May 2019, added 9 August 2019, 137.3 million addresses, data classes, bcrypt hashes)
Frequently asked questions
When was the Canva data breach?
It occurred in May 2019, and Have I Been Pwned added it on 9 August 2019.
How many accounts were affected?
About 137.3 million email addresses were affected.
What data was exposed?
Email addresses, usernames, names, cities of residence and passwords stored as bcrypt hashes for users who did not use a social login.
Do I need to change my Canva password?
Yes if you used Canva before 2019 or reused the password elsewhere. Use a unique password and two-step verification.
Is my current Canva account affected?
The breach was in 2019. Check your email against breach databases to see whether it appears, and secure your account.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.