The Seven Deadly Sins, a data-extortion crew that says it does not use ransomware, has seven organisations on its leak site as of 15 October 2026: Canva, Harness, iHeartJane, Verano Holdings, Cradlewise, Globeia and Brazil’s Hospital Sírio-Libanês. The group claims more than 230 million rows across the seven, three of the entries describe Salesforce CRM exports, and Canva has confirmed that a vendor compromise gave attackers access to business contact and contract data through its Salesforce connection. The other six companies have not commented, and every figure below is the operator’s claim unless stated otherwise.
Who are The Seven Deadly Sins?
The Seven Deadly Sins (TSDS) is a new extortion operation that takes data from cloud business applications and threatens publication, and says it does not use ransomware. The operator profile on the Ransomtracker recorded all seven entries within five minutes on 15 October, which is when the index first captured the group’s site rather than when each victim was posted; the Canva entry, for example, dates from late September. The group told DataBreaches.net that it had received low-eight-figure ransom payments in the preceding month and that it holds access to more than 300 Jira instances and dozens of Salesforce, HubSpot and Zendesk tenants belonging to large companies. None of that has been verified, but the Canva case shows the method is real.
How did the Canva data leave Salesforce?
Through a vendor. Canva uses Canny, a customer-feedback platform, and Canny’s integration was connected to Canva’s Salesforce account. DataBreaches.net reported in September that TSDS attacked Canny on 28 August, that Canny told Canva it was investigating unauthorised access on 29 August, and that the group had already exported Canva data between 26 and 28 August. Canva’s statement said the unauthorised access to Canny “allowed access to limited enterprise customer information” through its connection to the company’s Salesforce account, “including business contact details and contract information”. TSDS claims far more: the entire Salesforce org at more than two million CRM records, a product data warehouse of more than 200 million rows, enterprise licence orders and contract values, and billing attachments. Canva has not confirmed those figures.
The shape is familiar. The Salesloft Drift and Gainsight incidents of 2025 showed that a single third-party application with OAuth access to Salesforce can expose hundreds of tenants at once, and TSDS appears to be working the same seam. The Harness and iHeartJane entries both describe Salesforce objects, leads and contacts for Harness, cases, contacts and accounts for iHeartJane, which is what an exported CRM looks like rather than what a network intrusion looks like.
What is claimed for the other six?
The leak-site descriptions, as indexed by RansomLook, claim: more than 19 million rows for iHeartJane, the cannabis e-commerce platform, covering CRM records plus dispensary and point-of-sale data; 3.5 million rows for Hospital Sírio-Libanês in São Paulo, described as appointment, telehealth and patient records; 3.2 million rows and 43,000 baby registries for Cradlewise, a smart-crib maker, including IoT device data; 2.5 million rows of CRM contacts and pipeline notes for Harness, the DevOps platform; 2.4 million rows of customer, loyalty, invoice and point-of-sale data for Verano Holdings, a US cannabis multi-state operator; and 920,000 rows of applicant, identity and banking records for Globeia, a compliance software provider. Six entries carry 72-hour contact deadlines and Canva’s shows 60 hours. Verano’s entry is marked “in contact”, the group’s label for a victim that has opened negotiations, which is itself a claim.
The hospital entry is the most serious if true, because telehealth and appointment records are health data under Brazil’s LGPD and the hospital is one of the country’s best-known private providers. The cannabis entries matter for a different reason: dispensary purchase records tie named individuals to a product that remains federally illegal in the United States, which gives them a value to extortionists beyond ordinary retail data.
What does the stealer-log exposure show?
TSDS does not need malware on a victim’s network when a vendor’s OAuth token will do, but stolen sessions remain the cheapest way into a SaaS tenant. Stealercheck, which queries the Alerts.bar index that Ransomnews licenses, shows 356 staff-account credentials for hsl.org.br, 1,593 session cookies associated with harness.io and 1,049 with cradlewise.com, and more than 12,600 user-account credentials for iheartjane.com, most of them customer logins. These are cumulative aggregate counts and do not describe how TSDS obtained anything. They do illustrate why connected-app tokens and session cookies, not passwords, are the credentials that matter for cloud CRM security, a point we made in stealer logs explained.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
What should affected companies do?
Every company that connects third-party apps to Salesforce should audit which connected apps hold refresh tokens, revoke the ones nobody can justify, and restrict the rest to the objects they need. The named companies should assume their CRM contacts are in criminal hands and warn customers to expect convincing, well-informed phishing: an email that quotes a real contract value or support case is the obvious use of this data. Canva’s customers already have that warning. The others are waiting on companies that have said nothing while a 72-hour countdown runs.
What this means for SaaS supply chains
A group with no encryptor and one compromised vendor has produced seven brand-name listings and at least one confirmed data loss. That is the extortion economy of 2026 in miniature: access to a data platform is worth more than access to a network, and the vendors in the middle, feedback tools, analytics connectors and support integrations, are the softest point in it. We will update this article as the countdowns expire. The entries remain on the daily digest and in the 2026 year archive, and the live leak-site index will show when any of them changes status.
Frequently asked questions
Was Canva hacked?
Canva confirmed that unauthorised access to its vendor Canny reached limited enterprise customer information, including business contact details and contract information, through the vendor’s connection to Canva’s Salesforce account. The Seven Deadly Sins claims a far larger export that Canva has not confirmed.
Is The Seven Deadly Sins a ransomware group?
No. The group says it does not use ransomware and there is no evidence of encryption in any of its claims. It steals data from cloud applications and demands payment to withhold publication.
Which companies are on The Seven Deadly Sins leak site?
As of 15 October 2026: Canva, Harness, iHeartJane, Verano Holdings, Cradlewise, Globeia and Hospital Sírio-Libanês. Only Canva has confirmed any data loss.
What is the Salesforce connection?
Three of the seven entries describe Salesforce CRM exports, and Canva’s confirmed loss came through a vendor integration connected to its Salesforce account. The pattern matches the 2025 connected-app incidents in which third-party OAuth tokens exposed many Salesforce tenants.
Has Hospital Sírio-Libanês confirmed a breach?
No. The hospital had not commented as of 15 October 2026. The claim of 3.5 million rows of appointment, telehealth and patient data is the operator’s and is unverified.
Sources and further reading
- DataBreaches.net, Canva hacked via vendor’s Salesforce instance; other customers affected as well (23 September 2026, updated 26 September)
- RansomLook, The Seven Deadly Sins group page (posts indexed 15 October 2026)
- TechCrunch, Salesforce says some of its customers’ data was accessed after Gainsight breach (November 2025)
- Ransomnews Ransomtracker, The Seven Deadly Sins operator profile
- Related: Żabka confirms breach via supplier account, another vendor-credential intrusion we verified this year, and the threat-group catalogue
Reporting by the Ransomnews Research Team. Ransomnews has not examined the data samples, reproduces no personal data and does not link to leak sites. Exposure figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses.
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.