- Victims · 7d1−2 vs prior week
- Victims · 30d4
- Victims · 90d7
- All-time (tracked)7since 2026-08-29
- Last post11-03 21:23UTC
- Estimated earnings—public reporting
Profile · grok-4.7 · updated Summaries by Vani AI
Falcon is tracked on this dashboard as a low-volume data-extortion leak-site name, not as a group with a well-established profile in major vendor, law-enforcement, or blockchain reporting. Listings show three organizations since 2026-08-29—Hayward Holdings, Globus Medical, and DistributionNOW (DNOW Inc.)—with the last post on 2026-08-31 and none in the following 30 days. Origin, malware family, affiliate model, and whether Falcon encrypts systems or only extorts stolen data are unknown. Headlines supplied with this request about UNC6671 vishing, passkey-themed Microsoft 365 phishing, and BlackFile do not name Falcon and are not attributed to it. No public ransom-revenue estimate or intrusion-linked CVE set was identified.
Tactics & tooling
- Initial access: unknown
- Malware and tooling: unknown
- Data-extortion listings on a leak site observed
- Encryption versus theft-only model: unknown
- No public CVE or exploit set tied to this name
Targeted sectors
healthcare / medical devicesenergy-sector distribution
Notable public victims
Hayward Holdings, Globus Medical, DistributionNOW (DNOW Inc.)
Estimated earnings
No public figure.
Leak-site victims
7 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| Buchanan Ingersoll & Rooney PC | · 7h ago | 182 GB compressed · 260 GB uncompressed |
| Beasley Allen Law Firm | · 8d ago | 151 GB compressed · 214 GB uncompressed |
| Weitz & Luxenberg | · 9d ago | 47 GB compressed · 82 GB uncompressed |
| Astrana Health | · 9d ago | 470 GB compressed · 738 GB uncompressed |
| Hayward Holdings | · Aug 31, 2026 | 561 GB compressed · 848 GB uncompressed |
| Globus Medical | · Aug 29, 2026 | Medical devices · NYSE: GMED — 2.38 TB compressed, 2.96 TB uncompressed |
| DistributionNOW (DNOW Inc.) | · Aug 29, 2026 | Energy & industrial distribution · NYSE: DNOW — 182 GB compressed, 344 GB uncompressed |
In the news
AllVictim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .