Ransomware group falcon claims attack on Globus Medical

Key points

• The ransomware group calling itself "falcon" listed Globus Medical on its dark-web extortion site on 30 August 2026.
• The group's post claims it extracted approximately 2.96 terabytes of data from the company's systems.
• Globus Medical, a US medical-device maker traded on the New York Stock Exchange under the ticker GMED, has not publicly confirmed any incident.
• The listing was first observed by the monitoring service Ransomware.live and could not be independently verified at publication time.
• Ransomware listings are written by criminals to pressure victims into paying; they're sometimes exaggerated or false.

What is being claimed here?

Falcon, a criminal group that runs a dark-web extortion site, has named Globus Medical in a post claiming to hold nearly 3 terabytes of internal files. Ransomware groups run these so-called leak sites to pressure victims into paying ransoms to keep stolen data private.

The group's post describes an alleged haul of 2.96 terabytes, which would be enough to store tens of millions of documents. It lists a broad sweep of internal records. Threat Vectr isn't reproducing specifics: the post was written by the attackers to frighten the company into paying, not as an objective account of what they hold.

Globus Medical is a Pennsylvania-based maker of surgical implants and related medical devices, listed on the NYSE. No public statement from the company addresses the claim. We covered a comparable unverified listing against Boston Scientific on 26 August in "Boston Scientific Hit By Cyberattack, Global Order Shipments Disrupted", a case where a confirmed intrusion followed quickly. That's not guaranteed here, but it's the pattern worth watching.

Should patients or customers be worried?

Nothing is confirmed. That matters, because acting on an unverified claim carries its own risks.

Criminals sometimes use news of an alleged breach to launch follow-up scams. A caller offering "breach compensation" from Globus Medical, or an email urging you to click a link because your data was exposed, is almost certainly a scam feeding off this listing. Ignore those approaches entirely.

A few precautions cost nothing while things are unclear. If you've ever had a direct account or relationship with Globus Medical, watch for phishing, meaning fake emails designed to trick you into handing over passwords or personal details. Don't reuse the same password across multiple sites. Be wary of unexpected calls or texts about a data breach asking you to confirm personal information.

Should the company confirm an incident, Globus Medical would face breach-notification obligations under US federal and state law, and potentially disclosure requirements under the SEC's cybersecurity reporting rules, which took effect for large public companies in December 2023. Affected individuals would typically receive formal notice at that point.

For now, the claim is unverified. Threat Vectr will update this article if the company issues a public statement.