Canva has contacted the FBI to investigate the data breach.
Canva, an online graphic-design tool website operated from Australia has suffered a massive data breach in which personal data of over 139 million registered users has been stolen – The breach took place on Friday, May 24.
The stolen data includes usernames, real names, email addresses, city, and country information, etc. Canva, on the other hand, has acknowledged the breach and notified users in an email claiming that their payment card and other financial data is safe.
See: Sensitive data of 80 million US households exposed online
The company further maintains that the stolen passwords are in an encrypted format and “unreadable by external parties.”
“We’re aware that a number of our community’s usernames and email addresses have been accessed. The hackers also obtained passwords in their encrypted form (for technical people – all passwords were salted and hashed with bcrypt). This means that our user passwords remain unreadable by external parties.,” Canva said in an email sent to its users.
According to ZDNet, out of 139 million, 61 million users had their passwords encrypted with the bcrypt algorithm which is pretty secure format when it comes to cracking. Moreover, the data included Google tokens used by customers to log into Canva without registering an account.
In total, 78 million users had their Gmail based email addresses exposed in the breach, ZDNet who examined the sample data has confirmed.
Canva lets users sign in with their Facebook and Gmail account however while addressing the incident, the company assured users that their Facebook and Google credentials are also encrypted and unreadable by external parties and there is no need to change Facebook or Gmail password.
The incident has been reported to law enforcement authorities in Australia as well as to the Federal Bureau of Investigation (FBI).
The hacker involved Canva breach goes by the handle of GnosticPlayers who happens to be the same individual behind large scale data breaches in February this year involving sensitive data stolen from several companies including Gfycat. The data (126 million and 92 million accounts) was then sold on Dream dark web marketplace.
See: Freedom Mobile leaked millions of card data with CVV codes in plain text
If you have an account on Canva, change its password right now. Also, change the password of the email address which you have been using to sign into the website. Read more about the breach on Canva’s security incident FAQ page.
Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.
![[hlink][/hlink] The Slovakian crypto exchange suffered a targeted hack attack on Monday night. Crypto exchanges are the favorite targets of cybercriminals because let's face it, it can make you multi-millionaire within seconds and which is why attacking them is such common practice among hackers. This time, Eterbase, a Bratislava, Slovakia based cryptocurrency exchange was attacked, and a whopping $5 million were stolen. The notorious cybercriminals emptied several of its Hot Wallets and stole different types of cryptocurrencies. Hot wallets are those storages connected to the internet, whereas Cold Wallets aren’t accessible via the internet. Eterbase confirmed the news on its Telegram and Twitter channels on Tuesday, stating that six hot wallets of the exchange containing ether (ETH), ERC-20 tokens, bitcoin (BTC), XRP, Algorand (ALGO), and Tezos (XTZ) were compromised. In its official announcement, the exchange has also confirmed assets worth approximately $ 5.4 million were stolen. [wp_ad_camp_1] [wp_ad_camp_2] According to reports, the majority of the stolen crypto, roughly $3.9m, were stored in ERC-20 tokens and Ethereum. The second most affected cryptocurrency is XTZ since the value of stolen currency amounts to $417,000. The funds were transferred to different exchanges. Reportedly, the ETH funds went into the US’s Stablecoin, Tether, Compound, which is a non-custodial lending protocol, Uniswap, a decentralized exchange, and the centralized exchange Binance. Eterbase has suspended its trading operations until 10 Sep and has informed all ‘centralized exchanges’ that may receive the stolen funds. The exchange’s statement posted on Telegram read: “We have reported the matter to law enforcement and we are cooperating closely in the investigation. We want to assure our clients that we are taking all necessary steps to ensure that the amount of their deposit does not suffer any damage as a result of a hacker attack.” [hlink][/hlink] The exchange’s social media channels controller Nenad Ristic stated that personal information wasn’t stolen, and the company has enough funds available to oblige its customers. Did you enjoy reading this article? Do like our page on Facebook and follow us on Twitter.](https://hackread.com/wp-content/uploads/2020/09/hackers-attacked-european-crypto-exchange-eterbase-5-4-million-stolen.jpg)
