Canva Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Breach and Cyber Attack.

Total Financial Loss: The total financial loss from these incidents is estimated to be $10.22 million.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with password reset for users with decrypted passwords, remediation measures with password reset for users who hadn't updated theirs in the past six months, and communication strategy with notifying affected users, communication strategy with advising users to change their passwords, and containment measures with secured the exposed database, and communication strategy with notified affected creators, communication strategy with notified regulators, and third party assistance with gitguardian (secrets detection/remediation), third party assistance with hashicorp (research on credential-based breaches), and containment measures with proactive scanning for hardcoded secrets, containment measures with automated secret revocation, containment measures with contextual ownership assignment, and remediation measures with workflow-integrated remediation (e.g., pr fixes in version control), remediation measures with automated credential rotation, remediation measures with precision targeting of exposed secrets, and recovery measures with reduction of manual investigation time ($936k annual savings), recovery measures with elimination of false positives ($500k annual savings), and enhanced monitoring with real-time remediation tracking, enhanced monitoring with threat scope analysis for exposed secrets, and enhanced monitoring with recommended, and third party assistance with silent push (cybersecurity firm)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Compromised GitHub Action tokensHardcoded secrets in public/private repositories, Fake domains impersonating high-profile companies and SSO accounts (Okta).

Average Financial Loss: The average financial loss per incident is $2.04 million.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Usernames, Real Names, Email Addresses, Country Of Origin, Encrypted Passwords, Partial Payment Data, , Email Addresses, Survey Responses, , Api Keys, Tokens, Github Actions Secrets, Production Access Credentials, Nx Package Credentials, , Credentials, personally identifiable information, browser cookies, autofill details, Personally Identifiable Information (PII), Credentials and Business Data.

Third-Party Assistance: The company involves third-party assistance in incident response through GitGuardian (secrets detection/remediation), HashiCorp (research on credential-based breaches), , Silent Push (cybersecurity firm).

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: password reset for users with decrypted passwords, password reset for users who hadn't updated theirs in the past six months, , Workflow-integrated remediation (e.g., PR fixes in version control), Automated credential rotation, Precision targeting of exposed secrets, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by secured the exposed database, , proactive scanning for hardcoded secrets, automated secret revocation, contextual ownership assignment and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Reduction of manual investigation time ($936K annual savings), Elimination of false positives ($500K annual savings), .

Key Lessons Learned: The key lessons learned from past incidents are The incident highlights the need for proper configuration and security measures when using AI technologies to prevent data exposure.Workforce reductions amplify cybersecurity risks by stretching lean teams and prolonging remediation times.,Hardcoded secrets in code repositories/CI/CD pipelines are a critical blind spot, enabling cascading supply chain attacks.,Manual secrets management is unsustainable, wasting $1.4M annually and delaying incident response.,Detection alone is insufficient; remediation requires contextual ownership, infrastructure awareness, and workflow integration.,Automated tools (e.g., GitGuardian) can reduce remediation time from weeks to hours by pinpointing exposed secrets and assigning ownership.Password-only authentication is obsolete against large-scale credential dumps. Multi-factor authentication (MFA), especially phishing-resistant methods like FIDO2 security keys, is critical. Continuous monitoring of credentials against breach databases is essential.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Monitor credentials against breach databases continuously., Educate users on password hygiene and the risks of password reuse., Implement multi-factor authentication (MFA) and preferably phishing-resistant methods like FIDO2 security keys..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: ZDNet, and Source: UpGuard, and Source: IBM Security Cost of a Data Breach ReportUrl: https://www.ibm.com/reports/data-breach, and Source: HashiCorp State of Cloud Strategy SurveyUrl: https://www.hashicorp.com/resources, and Source: GitGuardian Secrets Detection ResearchUrl: https://www.gitguardian.com/resources, and Source: s1ngularity Attack Postmortem (GitHub Advisory)Url: https://github.com/advisories, and Source: Canva Incident Downtime Report, and Source: SecurityDiscovery.com, and Source: Cybernews, and Source: Silent Push, and Source: Okta.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Notifying Affected Users, Advising Users To Change Their Passwords, Notified Affected Creators and Notified Regulators.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Cisos: Advocate For Secrets Management Tools To Offset Lean Team Risks., Developers: Adopt Workflow-Integrated Remediation To Reduce Overhead., Executives: Balance 'Doing More With Less' With Cybersecurity Resource Allocation., Monitor For Notifications From Affected Platforms (E.G., Github, Canva)., Rotate Credentials If Potentially Exposed In Supply Chain Incidents. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Gitguardian (Secrets Detection/Remediation), Hashicorp (Research On Credential-Based Breaches), , Real-Time Remediation Tracking, Threat Scope Analysis For Exposed Secrets, , Recommended, Silent Push (cybersecurity firm).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Deploy **Automated Secrets Detection/Remediation Platforms** (E.G., Gitguardian)., Embed Remediation Guidance Into **Developer Workflows** (E.G., Ide Plugins, Pr Comments)., Establish **Cross-Team Playbooks** For High-Risk Secret Incidents., Prioritize **Preventive Scanning** In Ci/Cd Pipelines To Block Secrets At Commit., Measure And Report **Cost Savings** From Reduced Manual Effort ($1.4M/Year Potential)., , Adoption of MFA, continuous credential monitoring, and user education on password security.

Last Attacking Group: The attacking group in the last incident were an Gnosticplayers, ShinyHunters, Scattered LAPSUS$ Hunters (collective of Lapsus$, Scattered Spider and and ShinyHunters).

Most Recent Incident Detected: The most recent incident detected was on May 2019.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on May 2019.

Highest Financial Loss: The highest financial loss from an incident was $10.22 million (avg. U.S. breach cost); $11+ million with hardcoded secrets; $1.4 million annual waste on manual secrets management.

Most Significant Data Compromised: The most significant data compromised in an incident were usernames, real names, email addresses, country of origin, encrypted passwords, partial payment data, , Email addresses, Survey responses, , API Keys, Tokens, Production Access Credentials, GitHub Actions Tokens, Nx Package Credentials, , 26 billion records and Millions of records allegedly stolen.

Most Significant System Affected: The most significant system affected in an incident were Chroma Database and Code Repositories (GitHub, etc.)CI/CD PipelinesSlack/Jira/Collaboration PlatformsPrivate Repositories (82,901 exposed)Production Environments and .

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was gitguardian (secrets detection/remediation), hashicorp (research on credential-based breaches), , Silent Push (cybersecurity firm).

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Secured the exposed database and Proactive scanning for hardcoded secretsAutomated secret revocationContextual ownership assignment.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were real names, Tokens, Email addresses, API Keys, Survey responses, country of origin, Production Access Credentials, GitHub Actions Tokens, email addresses, 26 billion records, Nx Package Credentials, encrypted passwords, Millions of records allegedly stolen, partial payment data and usernames.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 26.0B.

Highest Fine Imposed: The highest fine imposed for a regulatory violation was Contributed to $10.22M avg. breach cost (U.S.).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Automated tools (e.g., GitGuardian) can reduce remediation time from weeks to hours by pinpointing exposed secrets and assigning ownership., Password-only authentication is obsolete against large-scale credential dumps. Multi-factor authentication (MFA), especially phishing-resistant methods like FIDO2 security keys, is critical. Continuous monitoring of credentials against breach databases is essential.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Adopt **automated credential rotation** to mitigate the impact of leaked secrets., Prioritize **high-risk secrets** (40% of exposed credentials provide production access)., Educate users on password hygiene and the risks of password reuse., Assign **clear ownership** for each secret to eliminate remediation delays., Monitor credentials against breach databases continuously., Advocate for **security resource alignment** with AI-driven efficiency initiatives to avoid critical gaps., Implement **proactive scanning** for hardcoded secrets during code commits and in existing repositories., Shift from reactive firefighting to **precision remediation** with contextual threat scope analysis., Implement multi-factor authentication (MFA), preferably phishing-resistant methods like FIDO2 security keys., Integrate remediation workflows into **developer tools** (e.g., automated PR fixes) to reduce context-switching., Quantify the **ROI of smart remediation** (e.g. and $1.4M annual savings from reduced manual effort)..

Most Recent Source: The most recent source of information about an incident are Cybernews, HashiCorp State of Cloud Strategy Survey, ZDNet, IBM Security Cost of a Data Breach Report, Silent Push, Canva Incident Downtime Report, SecurityDiscovery.com, s1ngularity Attack Postmortem (GitHub Advisory), GitGuardian Secrets Detection Research, Okta and UpGuard.

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.ibm.com/reports/data-breach, https://www.hashicorp.com/resources, https://www.gitguardian.com/resources, https://github.com/advisories .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (industry-wide trend analysis).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was CISOs: Advocate for secrets management tools to offset lean team risks., Developers: Adopt workflow-integrated remediation to reduce overhead., Executives: Balance 'doing more with less' with cybersecurity resource allocation., .

Most Recent Customer Advisory: The most recent customer advisory issued were an Monitor for notifications from affected platforms (e.g., GitHub and Canva).Rotate credentials if potentially exposed in supply chain incidents.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Fake domains impersonating high-profile companies and SSO accounts (Okta).

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was 30 days (domain registration).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Lack of authentication and proper configuration of the Chroma database, Underinvestment in secrets management amid workforce reductions.Overreliance on manual processes for credential rotation/exposure investigation.Lack of contextual ownership for remediation (multi-team coordination delays).Proliferation of unmanaged secrets across collaboration platforms (Slack, Jira).False positives overwhelming security teams ($500K annual cost)., Aggregation of historical breaches, potential inclusion of fresh infostealer malware data, and widespread password reuse, Vishing attacks, MFA manipulation, phishing kits, lack of awareness.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Deploy **automated secrets detection/remediation platforms** (e.g., GitGuardian).Embed remediation guidance into **developer workflows** (e.g., IDE plugins, PR comments).Establish **cross-team playbooks** for high-risk secret incidents.Prioritize **preventive scanning** in CI/CD pipelines to block secrets at commit.Measure and report **cost savings** from reduced manual effort ($1.4M/year potential)., Adoption of MFA, continuous credential monitoring, and user education on password security.