> Also, Canva hasn't accepted nor denied if their salt was compromised AFAIK, it's assumed that the salt is compromised with the hash - it's stored alongside t

> Also, Canva hasn't accepted nor denied if their salt was compromised AFAIK, it's assumed that the salt is compromised with the hash - it's stored alongside the hash. The point of the salt is to prevent lookups. Telling you to change your Facebook/google password _is_ pointless, as they don't have those. > Translation: "We don't know" I'm not sure what else they are supposed to say - saying they have could cause unnecessary panic and is probably misleading, but they can't conclusively say no as the evidence may have been hidden.