How a Stealer Log Grabbed 2,076,153 Logins Tied to Canva Users

A file named Canva 1 landed on Telegram in March 2025 and it was not small. It held 2,076,153 records, each one a saved login pulled off an infected device rather than lifted from Canva's own servers. The name refers to what the malware happened to grab, not necessarily a breach of the company itself, but that distinction does not make the exposure any less real for the people caught up in it.

Why This Is Dangerous

Here is the mechanism that got us here, infostealer malware infects a personal device, quietly reads everything saved in the browser, then bundles emails, passwords, and site URLs into one file before shipping it off to whoever is running the operation. When that file gets labeled after a popular service, it usually just means a large chunk of the victims happened to have accounts there, not that the platform's servers were breached.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs connecting each login to its source site
• 2,076,153 total records

Why This Matters

Over two million records is alot of exposure from a single file, and becuase the passwords sit in plaintext, there is nothing stopping anyone who downloads this log from immediately trying them elsewhere. If your Canva password doubles as your email or banking password, this log gives an attacker a running start on all three.

How Stealer Logs Work

The malware behind logs like this usually spreads through cracked software, fake browser extensions, or malicious ad downloads. Once it is on a machine, it scans the saved password manager built into the browser, grabs session cookies, and captures autofill fields, then compresses everything into a single log file. Those logs get sorted, sometimes by the platforms found inside them, and sold or shared across dark web forums and Telegram channels.

Check If You Are Affected

Instead of wondering whether your email is one of the 2,076,153, run it through HEROIC's free breach scanner. It checks against a database of over 400 billion leaked records, including logs like this one, so you can find out in seconds and reset any passwords that need it before someone else gets there first.