A group calling itself The Seven Deadly Sins stacked eight organizations onto its leak site within a four-minute window on October 16, and one of them is among Brazil’s largest private hospital networks.
Hospital Sirio-Libanes appears in the batch alongside Canva, software delivery firm Harness, cannabis marketplace iHeartJane, retail chain Verano Holdings, and infant-monitor maker Cradlewise. Canva’s claim is the loudest: the crew says it holds the company’s entire Salesforce org plus a data warehouse export. The hospital entry is thinner, describing the target as one of Brazil’s largest private groups and noting that Mangara Digital runs its national telehealth and PROADI programs.
Coordinated dumps inflate the count
Listings filed within minutes of each other are a signature of automated bulk posting, not eight separate intrusions found the same afternoon. Some entries in campaigns of this shape are recycled data sold between crews; others are inflated. That does not make them harmless.
Sirio-Libanes runs hospitals in Sao Paulo and Brasilia, plus teaching and research programs, while Mangara Digital delivers telehealth nationwide. Patient records, imaging, and clinical trial data all sit inside that perimeter. Brazil’s LGPD adds notification duties on top of the health-sector rules already governing hospital record handling.
The Salesforce claim, translated
A CRM export is not a patient record set, but it is rarely clean in healthcare-adjacent organizations. Salesforce instances collect support tickets, contact records, and case notes that routinely carry identifiers and clinical context. If the Canva claim reflects a real technique, hospital systems on the same platform should ask what their support and marketing clouds hold.
No victim has confirmed an intrusion and no sample files have surfaced. Treat the batch as a signal to check identity provider logs and third-party app authorizations, and to confirm no integration holds scopes broader than its business purpose requires.
