Canva

A Chroma database operated by Russian AI chatbot startup My Jedai was found exposed online, leaking survey responses from over 500 Canva Creators. The exposed data included email addresses, feedback on Canva’s Creator Program, and personal insights into the experiences of designers across more than a dozen countries. The data exposure was discovered by cybersecurity firm UpGuard, which confirmed the database was publicly accessible and lacked authentication.

Source: https://hackread.com/limited-canva-creator-data-expose-ai-chatbot-database/

TPRM report: https://www.rankiteo.com/company/canva

"id": "can900060925",
"linkid": "canva",
"type": "Breach",
"date": "6/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 571,
                        'industry': 'Design Platform',
                        'location': 'Australia',
                        'name': 'Canva',
                        'type': 'Company'},
                       {'industry': 'AI Chatbot Services',
                        'location': 'Russia',
                        'name': 'My Jedai',
                        'size': 'Microenterprise',
                        'type': 'Company'}],
 'attack_vector': 'Unsecured Database',
 'data_breach': {'number_of_records_exposed': 571,
                 'sensitivity_of_data': 'Moderate',
                 'type_of_data_compromised': ['Email addresses',
                                              'Survey responses']},
 'description': 'A Chroma database operated by Russian AI chatbot startup My '
                'Jedai was found exposed online, leaking survey responses from '
                'over 500 Canva Creators.',
 'impact': {'data_compromised': ['Email addresses', 'Survey responses'],
            'systems_affected': ['Chroma Database']},
 'lessons_learned': 'The incident highlights the need for proper configuration '
                    'and security measures when using AI technologies to '
                    'prevent data exposure.',
 'post_incident_analysis': {'root_causes': 'Lack of authentication and proper '
                                           'configuration of the Chroma '
                                           'database'},
 'references': [{'source': 'UpGuard'}],
 'response': {'communication_strategy': ['Notified affected Creators',
                                         'Notified regulators'],
              'containment_measures': ['Secured the exposed database']},
 'title': 'Chroma Database Exposure at My Jedai',
 'type': 'Data Exposure',
 'vulnerability_exploited': 'Lack of Authentication'}