Globus Medical Listed by Falcon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

A ransomware group known as Falcon has listed Globus Medical on its leak site, with a report dated August 29, 2026. The listing is an unverified claim by the group. Globus Medical has not publicly confirmed the claim as of writing. For patients, employees, suppliers, and others who deal with a major medical-device company, the practical stake is straightforward: if internal files were copied, personal and business information of the kind such firms often hold could be misused for fraud, phishing, or identity-related harm. Nothing in the public listing proves that any particular person’s data is involved, and the number of people affected is unknown.

What follows treats the Falcon post as a claim, not as established fact. Scale figures and sector labels in the listing come from the attackers’ own marketing and are not an independent inventory.

Inside the listing

According to the listing, Falcon has named Globus Medical and associated the entry with medical devices and the NYSE ticker GMED. The group claims a data volume of 2.38 TB compressed and 2.96 TB uncompressed. The listing does not disclose how many people might be affected, which specific file types or record categories are involved, when any alleged intrusion occurred, or what method was used. Those details remain undisclosed in the material provided.

A leak-site entry is a pressure tactic. Groups post company names and volume claims to push negotiations; listings can be exaggerated, incomplete, recycled, or false. Until the company, a regulator, or another independent source confirms otherwise, the public record on this matter is limited to Falcon’s claim and the absence of a matching public confirmation from Globus Medical.

The group behind it: Falcon

Falcon is known in public reporting as a ransomware and extortion actor that follows a familiar pattern: encrypt or exfiltrate data, then threaten publication on a dedicated leak site if payment demands are not met. Like other groups in this category, it typically relies on initial access through common enterprise weak points, moves laterally where it can, and uses the threat of dumping files to increase leverage. Prior public activity attributed to Falcon has centered on naming organisations and advertising purported haul sizes rather than releasing full forensic detail.

For this listing specifically, only what appears in the facts can be repeated: the group has listed Globus Medical, tied the name to medical devices and GMED, and stated the compressed and uncompressed volume figures above. No further victim-specific claims by Falcon are included in the available record, and none should be invented.

About Globus Medical

Globus Medical is a publicly traded company in the medical-devices sector (NYSE: GMED). Organisations of this type design, manufacture, and support implants, instruments, and related technologies used in surgical and clinical settings. They routinely work with hospitals, surgeons, distributors, employees, and business partners, and they operate under healthcare-adjacent privacy and quality expectations even when they are not a hospital themselves.

A claimed incident involving a firm in this sector matters because the ecosystem around medical devices often includes sensitive commercial files, regulated quality records, and contact or identity data for staff and counterparties. A leak-site listing does not by itself prove that any of those categories left the company. It does mean people who interact with Globus Medical may want to treat the claim as a prompt for ordinary vigilance until more is known.

The information in question

The Falcon listing does not name exposed data types. Exact contents are unconfirmed. If files were taken from a medical-device manufacturer, firms in this sector typically hold some mix of employee and contractor records, customer and hospital contact details, supply-chain and commercial documents, product and quality-related files, and internal business correspondence. That is a description of sector norms, not a statement of what—if anything—was copied here.

Readers should not assume their own records are in any alleged set. People affected, if any, remain unknown, and the attackers’ volume numbers are not a substitute for a verified data inventory.

What's at stake

If the claim were accurate and personal or business data were among the files, real-world risks would be the usual ones for corporate extortion cases: targeted phishing that references real relationships, account-takeover attempts, invoice or payment fraud aimed at suppliers, and longer-term identity misuse where names, addresses, or government identifiers appear. For the organisation, a public listing can bring reputational pressure, customer questions, and regulatory attention even before any independent confirmation.

None of that converts Falcon’s post into proof. A listing establishes that a named group chose to advertise this company and a claimed volume; it does not establish negligence, successful theft, or the sensitivity of any particular file. Conditional caution is warranted; certainty is not.

If your data was involved

Until there is confirmation and a clear notice about what was involved, treat steps as precautionary—useful if your information was caught up, not a declaration that it was.

• Watch for unexpected emails, calls, or texts that reference Globus Medical, medical devices, or related business relationships; verify requests through known official channels before clicking links or sending money or credentials.
• If you use accounts tied to work email or partner portals, enable multi-factor authentication where available and change passwords on important accounts if you reuse credentials across sites.
• Review bank and credit-card statements and, where appropriate, consider fraud alerts with major credit bureaus if you later receive a formal notice that identity data was involved.
• Keep any official notice from the company or a regulator; ignore pressure from strangers claiming they can “remove” your data for a fee.
• You can run a free exposure scan of your email to check whether your information has already surfaced in known breach data sets unrelated to this claim.

Public detail on this listing remains limited to Falcon’s unverified post dated August 29, 2026, the claimed volumes, and the absence of a public confirmation from Globus Medical. Further clarity, if it comes, will need to come from the company or independent authorities—not from the attackers’ marketing page.

AICompiled with AI assistance from public sources and published under our editorial standards.