A Case Study of Credential Stuffing Attack: Canva Data Breach

In May 2019, the hacker known as GnosticPlayers attacked Canva, an Australian tech giant, and was able to obtain data from 139 million users from this one attack alone. Overall, GnosticPlayers has data from nearly one billion users from attacking different platforms and companies. The technique they used to take all of this user data is called credential stuffing and credential cracking. Credential cracking is using brute force to find the passwords of users which could lead to finding the password to an admin account and being able to get information from all users. Credential stuffing is very similar, but it uses past information from previous breaches to be able to guess passwords more easily. This attack had a major impact on many people and companies who’s data was stolen adn can be prevented by multiple strategies including Multi. In response, Canva and other companies sent an email urging using to change their passwords for Canva, and if they use the same password for other sites, to change those as well. This paper analyzes the attack methodology, impact and possible defense solutions in detail.