---
title: "Dexcom employee-account compromise"
description: "Dexcom determined on November 2, 2026 that personal information may have been involved after social engineering gave a third party access to employee accounts and enabled file downloads. The notice does not date the initial intrusion."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-14"
canonical_url: "https://www.ally.security/incidents/dexcom-employee-account-compromise-2026"
markdown_url: "https://www.ally.security/incidents/dexcom-employee-account-compromise-2026.md"
stix_url: "https://www.ally.security/incidents/dexcom-employee-account-compromise-2026/stix.json"
---

# Dexcom employee-account compromise

Dexcom determined on November 2, 2026 that personal information may have been involved after social engineering gave a third party access to employee accounts and enabled file downloads. The notice does not date the initial intrusion.

Last modified Nov 14, 2026 · 2 sources

## Summary

- **Environment:** Employee accounts and accessible files
- **Operational impact:** Personal-information access or exposure reported; disruption not quantified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Dexcom](https://www.dexcom.com/) determined on November 2, 2026 that personal information may have been involved after social engineering gave a third party access to employee accounts and enabled file downloads. The notice does not date the initial intrusion. [2](#source-2)

## Impact

One recipient notice identifies names, addresses and limited health information, such as pharmacy, provider, birth date, prescription number, diagnoses or Dexcom-user status. For that recipient group, Social Security numbers and financial information were excluded. [2](#source-2)

A [separate recipient notice](https://oag.ca.gov/system/files/ELN-28926%20Dexcom.pdf) lists names, Social Security numbers, birth dates and government identification information, and offers two years of monitoring. The exclusions above apply only to the health-information recipient group. [1](#source-1)

## Timeline

### November 2, 2026 — Possible personal-information impact determined

Possible personal-information impact determined. [2](#source-2)

### November 14, 2026 — Briefing updated

This briefing was last reviewed and updated on November 14, 2026.

## Threat Group & Attack Vector

Social engineering gave the intruder access to employee accounts; the communication method is not specified. [2](#source-2)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): compromised employee accounts enabled file access. [2](#source-2)

## Response

Dexcom revoked access to compromised accounts, engaged external investigators and reinforced security-awareness training. It reported no ongoing unauthorized activity or indication of misuse. [2](#source-2) See the [notification](https://oag.ca.gov/system/files/ELN-28930%20Dexcom.pdf).

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/dexcom-employee-account-compromise-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Dexcom identity-information recipient notice

official · Dexcom, Inc.

<https://oag.ca.gov/system/files/ELN-28926%20Dexcom.pdf>

<a id="source-2"></a>

### Dexcom, Inc. security incident notice

official · Dexcom, Inc.

<https://oag.ca.gov/system/files/ELN-28930%20Dexcom.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Possible personal-information impact determined: 2026-11-02
2. **Used Attack Technique · 100% confidence · current**  
   Dexcom employee-account compromise: https://attack.mitre.org/techniques/T1078/
3. **Resulted In · 100% confidence · current**  
   Dexcom employee-account compromise: One recipient notice identifies names, addresses and limited health information, such as pharmacy, provider, birth date, prescription number, diagnoses or Dexcom-user status. For that recipient group, Social Security numbers and financial information were excluded.
4. **Resulted In · 100% confidence · current**  
   Dexcom employee-account compromise: Dexcom revoked access to compromised accounts, engaged external investigators and reinforced security-awareness training. It reported no ongoing unauthorized activity or indication of misuse.
5. **Affected Organization · 100% confidence · current**  
   Dexcom employee-account compromise: Dexcom, Inc.
6. **Resulted In · 100% confidence · current**  
   Dexcom employee-account compromise: A separate notice for another recipient group lists names, Social Security numbers, birth dates and government identification information, and offers two years of identity monitoring.
7. **Resulted In · 100% confidence · current**  
   Dexcom employee-account compromise: Dexcom determined on November 2, 2026 that personal information may have been involved after social engineering gave a third party access to employee accounts and enabled file downloads. The notice does not date the initial intrusion.
8. **Resulted In · 100% confidence · current**  
   Dexcom employee-account compromise: Possible personal-information impact determined

</details>