Natural fork race (two miners/pools find blocks at similar times), network latency/partition, or a large miner revealing a longer private chain. Depth 7 is uncommon but not unheard of; it doesn’t automatically mean an attack.