Learning from Canva’s Blunder – A Case Study in Crisis Public Relations

The name Canva is surely no stranger to us. This Australian startup, which provides graphic design software, has successfully attracted 15 million users from 190 countries around the world.

The large number of Canva users who have likely been loyal to this platform for over a year (like me) places a significant responsibility on Canva itself to communicate flawlessly with all of its stakeholders.

Unfortunately, for most tech companies that have emerged in the past 10 years, communication—let alone flawless communication—is not something they truly understand.

Timeline of the Crisis

To its 15 million users in 190 countries (including me), in late May 2019 Canva attempted to inform users that their system had been breached and that some Canva user data had been stolen by a hacker going by the alias “GnosticPlayes.” They claimed that by breaching Canva’s database, the hacker managed to steal 139 million records, including usernames, passwords, email addresses, real names, and even home addresses and cities of residence.

Sounds serious, right??

What did Canva do to warn (or fail to warn) its millions of users about this hacker threat?

They sent out a mass email with the subject line “Your Canva Account,” but the very first sentence in the email body actually mentioned the acquisitions of Pexels and Pixabay, which are set to bring a new experience to Canva users.

An opening message that, for many users, didn’t convey a sense of urgency.

It wasn’t until the next paragraph that Canva mentioned a security incident currently being handled by the FBI—specifically, the theft of user data, including email addresses and passwords.

And only in the closing paragraph did Canva ask its users to change their usernames and passwords as a precaution against this incident.

This so-called warning, presented in the form of a marketing email, was not perceived by many Canva users as a genuine warning. Some Canva users were angry for the following reasons:

1. It was tucked away in a marketing email, which usually announces promotions or new features

2. The subject line was “way too casual” for such a serious incident

3. The actual warning didn’t appear until the second paragraph

The anger of many Canva users is completely understandable. After all, who actually reads a marketing email all the way to the second or third paragraph—let alone the closing—right? If the subject line isn’t particularly important, most of us just skip over these marketing emails in our inboxes.

Back to how Canva communicated that there was an emergency. In communication studies, there’s a writing technique commonly used for hard news—or important, current events where the public demands information as quickly as possible—called the “Inverted Pyramid” technique.

In the inverted pyramid technique, the most important facts are laid out in the top paragraph—straightforward, without any unnecessary fluff. That way, when readers see the first paragraph, they immediately understand the urgency of the message and why they should keep reading the next paragraphs. And yes, the headline must also appear to be the most important element because it is positioned at the very top of the article.

If you look at the structure of the Canva post, the most important information—a call to action urging Canva users to change their usernames and passwords—is actually in the very last paragraph. Meanwhile, the least important and irrelevant information (regarding this incident)—about the acquisition and new features—is placed in the very first paragraph. Not to mention the subject line “Your Canva Account,” which in no way conveys a sense of urgency, causing email recipients to dismiss it as just another routine message.

What We Learn from the Canva Crisis

I’ve often (and very frequently) reminded startups and tech companies to be more careful, thorough, strategic, and sensitive when communicating with the public—both internally and especially externally.

Canva’s blunder teaches us that writing a message—especially during a crisis—cannot be “business as usual.” Startups and tech companies must understand that humans aren’t machines that simply receive and process messages (decoding) and will inevitably interpret the message 100 percent exactly as the sender intended (encoding).

If you’re a co-founder or employee of a startup, your company’s success isn’t determined by how much you’ve achieved so far. It’s determined by how many of your stakeholders perceive your startup as a success—even if the reality is harsher than it appears.

Have a communication strategy ready for when an emergency suddenly arises—who should draft the message, what the message should be, and how to convey it in a way that’s most acceptable to the public. The same applies to preparing communication strategies for announcing important matters such as B2B partnerships, corporate social responsibility (CSR) initiatives, or the company’s exceptionally impressive growth. 

It’s better to be a company that’s actually lackluster but appears brilliant than to be a company that’s brilliant on the surface but is actually lackluster.

History proves that companies (or political figures) that are actually opaque but appear glossy tend to be more enduring, healthier, and may even be more successful.

Because it’s all about public perception, as Chamfort said:

Public opinion is the worst of all opinions