{
  "id": "dexcom-employee-account-data",
  "url": "https://ohshit.app/incidents/dexcom-employee-account-data/",
  "title": "Dexcom says social engineering gave an attacker access to employee accounts",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-13",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Data breach",
    "Personal information"
  ],
  "ecosystems": [],
  "summary": "Dexcom says an intruder gained access to employee accounts through social engineering and was able to download files. Notices identify separate sets of potentially exposed identity and health data.",
  "splash": "People notified by Dexcom about files involved in the employee-account intrusion.",
  "wipe": "Verify your Dexcom notice and act on the fields it lists. Monitor credit or health records as applicable.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check which notice you received",
      "hint": "Use the letters filed with California to verify the notice. The identity-data letter offers two years of Kroll monitoring; use the membership number and deadline in your own letter to enroll."
    },
    {
      "title": "Check for unfamiliar credit or medical activity",
      "hint": "If your notice lists identity documents, review credit reports and consider a credit freeze with each bureau. If it lists health data, review pharmacy records and insurance statements and verify unfamiliar activity with your provider or insurer."
    }
  ],
  "sources": [
    {
      "name": "California Attorney General filing",
      "url": "https://oag.ca.gov/ecrime/databreach/reports/sb24-632867",
      "says": "Lists two company notices under the same incident.",
      "primary": true
    },
    {
      "name": "Dexcom identity-data notice",
      "url": "https://oag.ca.gov/system/files/ELN-28926%20Dexcom.pdf",
      "says": "Describes identity fields, containment and two years of Kroll monitoring.",
      "primary": true
    },
    {
      "name": "Dexcom health-data notice",
      "url": "https://oag.ca.gov/system/files/ELN-28930%20Dexcom.pdf",
      "says": "Lists health fields, excludes Social Security and financial data for this group, and gives a support number.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Dexcom confirmed unauthorized access through social engineering.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 2, 2026",
      "title": "Dexcom identifies possible exposure",
      "body": "Dexcom investigates with outside specialists and revokes compromised accounts’ access."
    },
    {
      "date": "Nov 13, 2026",
      "title": "California lists two Dexcom notices",
      "body": "One covers identity data and offers monitoring. The other covers limited health data."
    }
  ],
  "body_markdown": "Dexcom says the attacker was able to download certain files after gaining access to employee accounts. It revoked the compromised accounts’ access and reports no evidence of ongoing unauthorized activity or misuse. The notices give no total affected count. They describe exposure associated with corporate accounts and do not establish compromise of glucose monitors or their software.\n\nThe identity-data notice lists possible exposure of names, Social Security numbers, dates of birth and government identification information. The health-data notice lists names, addresses and potentially pharmacy, provider, birth date, prescription or diagnosis information, including whether someone uses Dexcom. That letter excludes Social Security numbers and financial information for its recipients and lists (844) 971-8641 for questions."
}