Globus Medical (NYSE: GMED), the Pennsylvania-based maker of musculoskeletal devices, was listed as a victim by the newly emerged Falcon data extortion group on August 30, 2026. Falcon claims it stole about 2.96 TB of data, according to both DataBreach.com and SINON. On October 18, DataBreach.com indexed a dataset it ties to the incident. The dataset contains 203,394 rows of personal records, including names, street addresses, phone numbers, email addresses and 8,866 bank account records. The company has not publicly confirmed Falcon's claims or the leaked dataset. On August 24, six days before the leak-site posting, Globus Medical published its own statement about a more limited intrusion. That statement and the attackers' account differ sharply. None of the sources available for this brief is a primary disclosure such as an SEC filing, regulator notice or breach notification letter, so treat everything below as reported, not verified.
What Happened
The timeline below combines DataBreach.com and SINON reporting:
- August 24, 2026: As reported by DataBreach.com, Globus Medical said it had recently found unauthorized access to "a limited subset of employee corporate email accounts, files and data." The company said it had activated its incident response protocols and contained the access. It also said preliminary findings showed no sensitive customer, consumer or patient information was exfiltrated.
- August 30, 2026: Falcon posted Globus Medical on its leak site, claimed responsibility and said it took roughly 2.96 TB of data. DataBreach.com lists this as the "attack date," but it is really the date of the leak-site posting. The intrusion itself must have happened earlier, because the company was already describing contained unauthorized access on August 24.
- August 30 to 31, 2026: SINON reports that Falcon listed two more NYSE-listed companies within 48 hours. DNOW was posted the same day with about 344 GB, and Hayward Holdings followed on August 31 with about 848 GB.
- October 18, 2026: DataBreach.com added a 203,394-row dataset attributed to the incident.
The sources leave one question open: is the email-account intrusion Globus disclosed on August 24 the same event Falcon is claiming? The timing suggests it is, but no source confirms the link. The company says the scope was limited and no sensitive data was taken. Falcon claims terabytes of customer and patient data. Those two accounts cannot both be fully accurate, and the information available today does not settle which one is closer to the truth.
What Was Taken
DataBreach.com's analysis of the indexed dataset found the following:
| Data type | Records |
|---|---|
| Full names | 203,394 |
| Street addresses | 106,139 |
| Phone numbers | 76,901 |
| Email addresses | 62,523 |
| Bank account records | 8,866 |
| Social Security numbers | 3,067 |
| Dates of birth | 2,860 |
Not every record contains every field. SSNs and dates of birth appear in DataBreach.com's detailed breakdown but not in its headline field list.
Falcon's leak-site post goes much further. It claims the data includes customer records, regulatory filings, product complaint logs, distribution contracts, and patient demographics and history from clinical registries. Only the attackers have made these claims, and no one has independently verified them.
There are two ways to measure the scale. Falcon claims about 2.96 TB of raw data, as reported by DataBreach.com and SINON. The structured personal records indexed so far total 203,394 rows, according to DataBreach.com alone. The two figures measure different things, and the indexed rows may be only part of what was taken. No source gives a count of affected individuals that the company has verified.
The most sensitive items are the bank account records and SSNs. If the patient registry claims turn out to be true, the incident would raise HIPAA questions as well, but nothing published so far confirms that.
Why It Matters
The victim profile looks deliberate. SINON's analysis points out that Falcon's first three publicly known victims are all NYSE-listed, and they have nothing else obvious in common. SINON's theory is that the SEC's cyber disclosure rule, in force since December 2023, works as a lever for extortion. A listed company that judges an incident material must file a Form 8-K within four business days, which gives the attacker a deadline that someone else enforces. A private company negotiating quietly faces no such clock.
This is pure data extortion. SINON describes Falcon as financially motivated and reports no signs of encryption, downed systems or ransom notes. Data is stolen and then held for ransom under threat of publication. EDR and backup strategies built to stop encryption do little against this model. What matters is detecting large outbound data transfers.
Medtech supply chains are a busy target. BlackFog's September 2026 roundup and Secret CISO's September 6 newsletter both describe a period of heavy extortion activity across healthcare and its supply chain. Examples include Amgen's disclosed cloud intrusion and a reported $55M demand against McKesson. Neither source names Globus Medical, but together they show the environment this incident sits in.
A note on the name. The "Falcon" in Secret CISO's September 6 issue refers to an exploit for CrowdStrike's Falcon sensor, called FalconFlank. It has nothing to do with the Falcon extortion group. Analysts should keep the two separate when they triage alerts.
The Attack Technique
None of the sources disclose an initial access vector. Two details are reported:
- The company's August 24 statement, as relayed by DataBreach.com, describes unauthorized access to employee corporate email accounts, files and data. That fits credential compromise, phishing or session hijacking, but the company has not said how access was obtained.
- SINON's profile of Falcon describes exfiltration followed by extortion, with no encryption.
Falcon claims it took business documents such as contracts, regulatory filings and complaint logs, as well as personal records. If that is accurate, the attackers reached file shares or cloud document stores, not only mailboxes. That would go beyond the "limited subset" the company described. This is unconfirmed.
What Organizations Should Do
- Harden email and identity. Enforce phishing-resistant MFA on corporate mailboxes. Monitor for new inbox rules, OAuth consent grants and logins from unfamiliar ASNs. Revoke active sessions whenever a credential reset follows a suspected compromise.
- Detect bulk exfiltration, not just encryption. Alert on unusual outbound volume from file servers, SharePoint/OneDrive and mailbox export APIs. A 2.96 TB transfer should not go unnoticed.
- Plan for disclosure and extortion together. Listed companies should decide on materiality criteria and an 8-K process before an incident happens, so extortion deadlines don't push them into rushed filings.
- Watch leak sites and breach indexers. Track new groups like Falcon and aggregators like DataBreach.com for your company name and key suppliers. Here the data surfaced roughly seven weeks after the leak-site post.
- Prepare for downstream fraud. If you are a Globus Medical customer, distributor or partner, expect convincing phishing and invoice fraud that uses the leaked contact and banking details. Verify any change to payment instructions through a separate channel.
- Treat attacker claims with care. Assess what leaked data actually contains before accepting either the attacker's description or early assurances from the victim. In this case the two accounts do not match, and only forensics or a regulatory filing will settle it.
Sources: Globus Medical Search the Data Breach | Falcon Ransomware Group: First Three Victims All NYSE-Listed · SINON | The State of Ransomware: September 2026 | Intelligence Center · SINON | Christopher Zukowski | Jeremy Zivitz | Secret CISO 9/6: McKesson's $55M Ultimatum, Wesco Data Dump, CrowdS... | View Shortable Securities Interactive Brokers LLC