The Seven Deadly Sins, a new extortion group, claims seven attacks on its first day of activity
A previously unknown group, The Seven Deadly Sins, posted seven alleged victims on its leak site on 15 October 2026, including technology firms and a Brazilian hospital. The claims are unverified, but they mark the arrival of a new actor worth monitoring.
What happened
On 15 October 2026 a new leak site attributed to a group calling itself The Seven Deadly Sins went live. The same day it published seven entries which, according to the group itself, correspond to organisations it has attacked. This is the group's total activity recorded so far by the tracking platform RansomLook.
The organisations the group claims include Canva (Australia, technology), Harness and Globeia (technology), Verano Holdings (United States, retail), iHeartJane and Cradlewise (retail) and Hospital Sírio-Libanês (Brazil, healthcare). None of these claims has been confirmed by the organisations named or by news reports in the available data, and the group has not detailed what information it says it obtained.
Who the group is
Very little is known. The Seven Deadly Sins does not appear in reference catalogues such as MISP Galaxy or MITRE ATT&CK, publishes no description of itself and there are no reports pointing to earlier activity. Its name does not resemble any known group either, so it is classified as new, although the evidence is thin: it could be a genuinely new actor or a rebrand of an existing one.
Posting several victims at once when launching a site is a common tactic to gain attention and pressure companies, so the figure does not mean all the attacks took place on that day.
What organisations can do
Because the group's initial access methods and tools are not yet known, the recommended measures are the baseline defences against any extortion group:
- Enforce multi-factor authentication on remote access, email and admin consoles.
- Prioritise patching of internet-facing systems such as VPNs and remote gateways.
- Keep offline backups and regularly test restoring them.
- Monitor for unusual data transfers to external services.
- Review access granted to technology suppliers and cloud services.
- Have an incident response plan ready, covering communication and legal obligations.
About the group: The Seven Deadly Sins
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.