Canva Data Breach Exposes Sensitive Information of 424 Turkish Organizations A recent data breach at Australian graphic design platform Canva has compromised sensitive information tied to 424 organizations in Türkiye, as confirmed by the country’s Personal Data Protection Authority (KVKK). The breach stemmed from unauthorized access to a third-party tool used by Canva as a data controller. A threat actor exploited a connection with the platform’s data processor, extracting personal and business-related data belonging to employees of Canva’s customers. While the exact number of affected individuals in Türkiye remains unclear, the exposed data includes: - Personal details (first and last names, work email addresses, workplace locations, and business phone numbers) - Business documents (customer order forms, contracts, invoices, data protection agreements, and master service agreements) - Routine correspondence conducted through Canva’s platform The incident highlights the risks of third-party integrations in data processing, with potential implications for corporate security and compliance. The KVKK’s notice did not specify the timeline of the breach or the identity of the threat actor.