Globus Medical, a medical device company headquartered in Audubon, Pennsylvania, was reportedly named on a dark web leak site in August 2026 by a cybercriminal group that claims to have obtained company and customer information. As of this writing, Globus Medical has not publicly confirmed the incident, and the full scope of what happened remains under investigation.
When a company holds names, contact details, or medical information about the people it serves, it takes on a responsibility to keep that information secure and to notify those affected promptly if it is compromised.
Globus Medical’s Data Breach Investigation
According to a posting identified on a dark web leak site, a cybercriminal group calling itself Falcon claimed responsibility for a cybersecurity incident involving Globus Medical. The claim, reportedly made in August 2026, states that the group obtained data connected to Globus Medical’s business operations, including information tied to the company’s customers. The specific systems said to have been accessed, and how the alleged intrusion occurred, have not been detailed in the public posting.
Globus Medical has not issued a public statement confirming or describing the incident as of this writing, and it is not yet known whether the company has begun notifying individuals whose information may have been involved. That silence is not unusual in the early stages of a suspected breach: companies typically need time to verify a threat actor’s claims, determine what systems or data sets were actually accessed, and coordinate with forensic investigators before making any public statement or sending notification letters.
Cybercriminal groups that publish claims on dark web leak sites are frequently attempting to pressure a victim organization into paying a ransom, and the claims they post are not independently verified by anyone outside the company itself. That said, dark web leak-site claims involving healthcare and medical device companies have, in numerous other cases over the past several years, turned out to correspond to real breaches once the affected company completed its own investigation and issued formal notice. Medical device and healthcare-adjacent companies are attractive targets for this kind of attack because the customer and patient records they hold, including names, contact information, and medical details, can be valuable for identity theft and are often subject to state and federal data breach notification laws once a company confirms an incident occurred.
If Globus Medical confirms that customer or patient data was exposed, the company would generally be required under state data breach notification statutes to notify affected individuals within a legally defined window, and in some cases to notify state regulators as well. Those notification letters, once issued, typically describe what categories of information were involved and what resources, such as free credit monitoring, the company is making available to those affected. Anyone who receives such a letter, or who has reason to believe their information may have been involved based on public reporting, should keep it for their records and take the precautionary steps outlined below.
When Did This Breach Occur?
The exact date of the underlying incident has not been publicly disclosed by Globus Medical. The claim from the group identifying itself as Falcon was reportedly posted to a dark web leak site in August 2026, but a leak-site posting date does not necessarily correspond to when unauthorized access actually occurred, since threat actors often gain access weeks or months before making a public claim. Globus Medical has not released a timeline of when it discovered or began investigating the incident. This page will be updated with more specific dates if and when the company issues an official notification.
What Information Was Breached?
The group that claimed responsibility for the incident stated that the data it obtained may include names, addresses, email addresses, and medical information connected to Globus Medical’s business and customers. Globus Medical has not confirmed which, if any, specific categories of information were actually involved, and the company has not released an official list of affected data types. Individuals who receive a formal notification letter from Globus Medical should review it carefully, as it will identify the specific types of information the company has confirmed were involved in their case.
What You Can Do
If you believe your information may have been exposed in connection with Globus Medical, consider the following steps:
- Monitor your bank and credit card statements, as well as your credit reports, for any unfamiliar or suspicious activity.
- Consider placing a fraud alert or credit freeze with the three major credit bureaus: Equifax, Experian, and TransUnion.
- Be cautious of phishing emails, texts, or phone calls that reference Globus Medical or claim to be following up about a data breach.
- Change passwords on any accounts that may be connected to the information involved, and enable two-factor authentication where available.
- Keep any notification letter or communication you receive from Globus Medical, as it may be useful if you decide to pursue legal action.
File a Data Breach Lawsuit Against Globus Medical
Companies that collect and store personal and medical information are expected to maintain reasonable safeguards to protect that data from unauthorized access. When a data breach occurs, individuals whose information was exposed may have legal options, including the ability to pursue compensation through a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
