Why did I get an email about Canva?
The Queen’s IT Services Security team recently became aware of a data breach at Canva, a graphic design website. This event may have potentially affected multiple accounts here at Queen’s. As a precaution, Queen’s IT Services will expire the passwords of any Queen’s account found to be listed on the breached Canva accounts list who have not changed their NetID passwords since June 1, 2019.

What should I do to protect myself?
If you received an email message concerning the breach, and have not changed your NetID password since June 1, 2019, you will be sent additional emails prior to your password expiring to change your password. NetID passwords are changed at https://netid.queensu.ca/selfservice/login/auth. 
We also encourage you to take the following actions to better protect yourself and your information:

• Do not reuse passwords across your accounts.


• If you have used your Queen’s password on multiple sites we strongly encourage you to change that password on every other site where it has been used.

What data was compromised?
Any user who created an account on the Canva website using their Queen’s email address or NetID was potentially included in the breach.  If the user also supplied the same password as that used with their Queen’s account, then the user’s Queen’s account was potentially compromised.
Canva has published information here concerning the information that was compromised in the breach.

Why is Queen’s expiring passwords for potentially breached accounts?
Queen’s account holders who fail to follow safe password practices are at risk when breaches like this occur. To protect your Queen’s account IT Services are taking this action to prevent account compromises by expiring the passwords of all accounts associated with the breach that have not refreshed their NetID passwords.

What caused the data breach?
Canva has additional information about the cause of the breach.