Summary
- Environment: Employee accounts and accessible files
- Operational impact: Personal-information access or exposure reported; disruption not quantified
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.
What happened
Impact
One recipient notice identifies names, addresses and limited health information, such as pharmacy, provider, birth date, prescription number, diagnoses or Dexcom-user status. For that recipient group, Social Security numbers and financial information were excluded. [2]
A separate recipient notice lists names, Social Security numbers, birth dates and government identification information, and offers two years of monitoring. The exclusions above apply only to the health-information recipient group. [1]
Timeline
Possible personal-information impact determined
Possible personal-information impact determined.
[2]Briefing updated
This briefing was last reviewed and updated on November 14, 2026.
Threat Group & Attack Vector
Social engineering gave the intruder access to employee accounts; the communication method is not specified. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts: compromised employee accounts enabled file access. [2]
Response
Dexcom revoked access to compromised accounts, engaged external investigators and reinforced security-awareness training. It reported no ongoing unauthorized activity or indication of misuse. [2] See the notification.