Dexcom: Dexcom class action claims weak security led to data breach

Dexcom Faces Class Action Over Alleged Data Breach by ShinyHunters

Dexcom, a leading manufacturer of continuous glucose monitors with over 2.8 million users worldwide, is the target of a class action lawsuit filed on October 13, 2026, in the U.S. District Court for the Southern District of California. The suit, brought by plaintiff Donovan Hart, alleges the company’s inadequate data security enabled hackers to steal sensitive personal and medical information.

The breach was claimed by the cybercriminal group ShinyHunters, which announced on October 1, 2026, that it had compromised Dexcom’s network and threatened to publish the stolen data unless contacted. The exposed information reportedly includes names, dates of birth, driver’s license numbers, financial details, medical records, and health insurance data.

Dexcom acknowledged a separate incident on October 10, 2026, involving voice phishing calls that led to unauthorized access to internal documents but did not confirm whether this was the breach ShinyHunters referenced. The company stated its products remain secure and that affected individuals would be notified as needed.

The lawsuit alleges multiple security failures, including inadequate employee training, substandard access controls, and delayed incident response, which it claims violate HIPAA, the FTC Act, and California medical privacy laws. Hart, a former Dexcom customer, asserts the breach caused anxiety, stress, and time spent monitoring for identity theft.

The legal claims include negligence, negligence per se, breach of implied contract, and unjust enrichment, with demands for compensatory and punitive damages, restitution, and court orders to protect affected users. The proposed class covers all U.S. residents whose data was compromised in the October 2026 breach, though no settlement or claims process has been established.

Source: https://www.claimdepot.com/cases/dexcom-hit-with-class-action-over-alleged-data-breach-exposing-health-records

Dexcom TPRM report: https://www.rankiteo.com/company/dexcom

"id": "dex1792182979",
"linkid": "dexcom",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'All U.S. residents whose data '
                                              'was compromised in the October '
                                              '2026 breach',
                        'industry': 'Medical Devices / Healthcare',
                        'location': 'United States',
                        'name': 'Dexcom',
                        'size': '2.8 million users worldwide',
                        'type': 'Company'}],
 'attack_vector': 'Unknown (allegedly enabled by inadequate security controls)',
 'customer_advisories': 'Affected individuals will be notified as needed',
 'data_breach': {'data_exfiltration': 'Yes (threatened to publish)',
                 'personally_identifiable_information': 'Names, dates of '
                                                        'birth, driver’s '
                                                        'license numbers',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personal Identifiable '
                                              'Information (PII)',
                                              'Medical Records',
                                              'Financial Details',
                                              'Health Insurance Data']},
 'date_detected': '2026-10-01',
 'date_publicly_disclosed': '2026-10-13',
 'description': 'Dexcom, a leading manufacturer of continuous glucose monitors '
                'with over 2.8 million users worldwide, is the target of a '
                'class action lawsuit alleging inadequate data security '
                'enabled hackers to steal sensitive personal and medical '
                'information. The breach was claimed by the cybercriminal '
                'group ShinyHunters, which threatened to publish the stolen '
                'data unless contacted. The exposed information includes '
                'names, dates of birth, driver’s license numbers, financial '
                'details, medical records, and health insurance data.',
 'impact': {'customer_complaints': 'Anxiety, stress, time spent monitoring for '
                                   'identity theft',
            'data_compromised': 'Names, dates of birth, driver’s license '
                                'numbers, financial details, medical records, '
                                'health insurance data',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Class action lawsuit, potential regulatory '
                                 'fines',
            'payment_information_risk': 'High'},
 'investigation_status': 'Ongoing',
 'motivation': 'Extortion (threat to publish stolen data)',
 'post_incident_analysis': {'root_causes': ['Inadequate employee training',
                                            'Substandard access controls',
                                            'Delayed incident response']},
 'ransomware': {'data_exfiltration': 'Yes'},
 'references': [{'source': 'Class Action Lawsuit Filing'}],
 'regulatory_compliance': {'legal_actions': 'Class action lawsuit',
                           'regulations_violated': ['HIPAA',
                                                    'FTC Act',
                                                    'California Medical '
                                                    'Privacy Laws']},
 'response': {'communication_strategy': 'Acknowledged incident, stated '
                                        'products remain secure, and notified '
                                        'affected individuals as needed'},
 'threat_actor': 'ShinyHunters',
 'title': 'Dexcom Faces Class Action Over Alleged Data Breach by ShinyHunters',
 'type': 'Data Breach'}