1. Executive summary
A threat group calling itself The Seven Deadly Sins (TSDS) has stood up a dedicated leak site that lists Canva Pty Ltd among organisations that have not paid, and a group spokesperson told DataBreaches that TSDS attacked on 28 August. Reporting attributes the intrusion to a vendor’s Salesforce instance and states that other customers of that vendor were affected, but the vendor is not named in the source material and no technical detail of the intrusion is published. The verified reference data carries no CVE, no CVSS score, no EPSS value and no CISA KEV entry for this item, and TSDS has no MITRE ATT&CK profile, so the attribution is unconfirmed. For EMEA financial services clients the exposure is indirect and supply-chain shaped: any use of Canva, or of the unnamed shared Salesforce-based vendor, puts corporate identity material and marketing or design workflows inside the blast radius. The single-source nature of the reporting means the incident scope should be treated as unverified until the vendor or Canva confirms it.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | The reported entry point is a vendor’s Salesforce instance, so an ICT third-party provider’s system is the stated vector rather than the client’s own estate. | Clients must be able to identify that provider in their register of information and hold contractual rights to incident notification and cooperation from it. Where the provider is unnamed in reporting, the register cannot be reconciled until the vendor is identified. |
| DORA Art. 29: preliminary assessment of ICT concentration risk | The same vendor instance is reported to have affected other customers besides Canva, which is the shared-instance fact. | Clients using the same provider should assess whether a single shared instance creates correlated exposure across their own portfolio, and whether exit or substitution is feasible. |
No DORA Art. 19 or NIS2 Art. 23 reporting obligation is engaged on the facts available: neither Canva nor the unnamed vendor is identified as an EMEA financial entity, and no client-side incident is described. If a client’s own tenant is later confirmed compromised, that assessment changes.
3. Technical analysis & attack chain
The source material does not support a step-by-step attack chain. What is confirmed from the reporting is limited to the following.
- TSDS operates a dedicated leak site and lists Canva Pty Ltd on it among organisations that have not paid.
- A TSDS spokesperson told DataBreaches that the group attacked on 28 August. The source does not state what was attacked, how access was obtained, or what was taken.
- Reporting attributes the intrusion to a vendor’s Salesforce instance and states that other customers of that vendor were also affected.
Everything else is missing. The source does not name the vendor, does not identify the Salesforce product or edition involved, does not describe the initial access vector, does not state whether credentials, OAuth tokens, API keys or session material were used, and does not give any indicator of persistence, privilege escalation, command-and-control or lateral movement. No malware, payload, filename, port, protocol or command line is given. No data sample, record count or exfiltration volume is published, and no ransom figure is stated.
Two points of interpretation are worth separating from the facts. First, the leak-site listing and the "haven’t paid them" framing describe extortion with a data-theft threat; nothing in the source indicates encryption or ransomware deployment, and this advisory does not characterise it as ransomware. Second, the claim that other customers of the same vendor were affected is the most consequential detail for EMEA clients, because it implies a shared instance rather than a Canva-specific compromise, but it rests on a single outlet’s reporting of a group spokesperson’s account. Treat the shared-instance claim as single-sourced and unverified.
Attribution is unconfirmed. The verified reference data records no MITRE ATT&CK profile for The Seven Deadly Sins, so no TTP mapping, no tooling association and no prior-campaign linkage can be asserted. The group name is self-assigned and the leak site is new, which is consistent with either a new operation or a rebrand, and the source does not distinguish between the two.
4. Mitigation & containment
The absence of technical detail limits what can be actioned directly. The steps below address the supply-chain and identity exposure the reporting does describe.
P1 (within 24 hours)
- Establish whether your organisation holds Canva accounts, and whether any design, marketing or brand workflow is federated to Canva through corporate SSO. If it is, pull identity-provider sign-in logs for the period from 28 August 2026 onward and look for sessions from unfamiliar ASNs, new device registrations, and consent grants to third-party applications.
- Ask your procurement and vendor-management functions to identify any Salesforce-based vendor that serves multiple clients in your portfolio. The vendor is unnamed in reporting, so this is a reconciliation exercise against your own register of information rather than a lookup.
- If Canva is used with corporate email addresses, treat those addresses as potentially exposed to targeted phishing and raise the alert threshold on inbound mail referencing Canva, design assets or shared documents.
P2 (within 72 hours)
- Rotate credentials and revoke active sessions, refresh tokens and personal access tokens for any Canva account or integration, and review connected applications for grants that were not made by a known administrator.
- Review API keys and service accounts that touch the same email domain, on the assumption that credential reuse across SaaS is the cheapest path an actor has from a vendor compromise into a client tenant.
- Confirm with the vendor, once identified, whether your tenant sits on the affected instance and whether the vendor has notified you under the terms of your contract.
P3 (within 7 days)
- Update the register of information with the outcome of the P1 reconciliation, including any provider that could not be identified, and record the gap explicitly.
- Re-run the concentration assessment for any provider that serves multiple business units or entities, and document whether substitution is feasible.
- Tabletop the scenario the reporting implies: a shared SaaS vendor is compromised, the vendor does not name affected customers, and you learn of your exposure from a leak site.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source names no domain, IP address, URL, hash, file path, registry key, email address or account identifier. The leak site itself is referenced but its address is not published in the material provided, so no network indicator can be emitted. There are also no behavioural indicators with enough specificity to observe: the only described behaviour is the existence of a leak-site listing, which is not a detection surface.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- DataBreaches.net, "Canva hacked via vendor’s Salesforce instance; Other customers affected as well", https://databreaches.net/2026/09/23/canva-hacked-via-vendors-salesforce-instance-other-customers-affected-as-well/, 2026-09-23.
8. Adverse Trace position
We assess this as an unverified, single-sourced extortion claim with no technical corroboration and no attributable actor profile. No CVSS score, severity rating or CISA KEV exploitation state can be assigned, because the verified reference data contains no CVE for this item; any severity figure quoted elsewhere for this incident is not supported by the reference data we hold. The client-impact assessment is that direct exposure is limited to organisations using Canva or the unnamed shared Salesforce vendor, while indirect exposure through credential reuse and targeted phishing is broader and harder to bound. We will monitor for the vendor name, for any Canva or vendor confirmation of scope, and for the leak site publishing samples that would let us confirm what was taken; we will issue a follow-up if the shared-instance claim is corroborated by a second source or by the vendor. Clients who identify the vendor in their own register should tell their Adverse Trace contact so we can correlate across the client base.
Published via PulseTrace — Adverse Trace threat intelligence.