# The Seven Deadly Sins RaaS Group - Multi-Victim Data Leak Campaign (Oct 2026)

> RansomLook tracks 'The Seven Deadly Sins' as a ransomware operation that posted seven victims on its leak site on 2026-10-15, spanning SaaS, healthcare, cannabis, government-services and consumer-IoT sectors. Claimed stolen data includes customer PII, patient records, Salesforce CRM data and financial records; all claims are group-posted and unverified.

- **Published:** 2026-10-15T13:59:51Z
- **Last reviewed:** 2026-10-15T13:59:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3624
- **ID:** TL-2026-3624
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Seven Deadly Sins
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Seven Deadly Sins is a ransomware / data-extortion group profiled by the RansomLook aggregator. As of 2026-10-15 the profile lists 7 total posts, all dated 2026-10-15, each carrying a short countdown (72 hours to contact for most victims, 60 hours for Canva Pty Ltd) typical of double-extortion pressure tactics.

Victims claimed on the leak site: Cradlewise Inc. (baby registry data, parent emails and addresses, IoT keys, e-commerce integrations; no contact), Hospital Sirio-Libanes (patient records, appointment data, FHIR/SOAP notes, health records; no contact), Globeia Inc. (government applicant data, SSNs, passport and banking details; no contact), Verano Holdings Corp. (customer credentials, loyalty data, employee records, state IDs; marked as in contact), Harness Inc. (enterprise CRM data, contact information, sales pipeline notes), iHeartJane (cannabis marketplace data, dispensary information, POS records) and Canva Pty Ltd (Salesforce records, enterprise licenses, order documentation). Row counts claimed in aggregator/search snippets range from roughly 0.9M to 19M+ rows, with the largest case exceeding 19M rows. The recurrence of Salesforce/CRM data across several postings suggests SaaS CRM environments are a targeted data source, though the intrusion vector is not stated by any source.

The group's three leak-site endpoints, one Tor onion service and two clear-web IP mirrors, were all reported as down at the time of the RansomLook snapshot. No CVE, malware family, encryptor, initial access vector, tooling or attribution (actor aliases, nation-state, affiliates) is documented in the available source. Searches for corroboration (general web search, ransomware.live, BeaconBeagle lookups for both IPs) returned nothing: the BeaconBeagle API returned HTTP 404 for 185.100.85.146 and 37.72.140.179, i.e. no C2 correlation. This record therefore relies on a single aggregator source; victim claims have not been independently verified and none of the named organizations has confirmed a breach in the sources reviewed. The 'Seven Deadly Sins' name should not be confused with unrelated 'seven deadly sins of cybersecurity' marketing reports (e.g. the SonicWall 2026 Cyber Protect Report).

## MITRE ATT&CK

- T1657 Financial Theft
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1583 Acquire Infrastructure

## Sources

- [RansomLook - The Seven Deadly Sins group profile](https://www.ransomlook.io/group/the%20seven%20deadly%20sins)
- [RansomLook - ransomware leak-site tracker](https://www.ransomlook.io/)
- [MITRE ATT&CK T1486 Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486/)
- [MITRE ATT&CK T1657 Financial Theft](https://attack.mitre.org/techniques/T1657/)
- [MITRE ATT&CK T1213 Data from Information Repositories](https://attack.mitre.org/techniques/T1213/)
- [MITRE ATT&CK T1530 Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3624