Dexcom says social engineering gave an attacker access to employee accounts
Dexcom says an intruder gained access to employee accounts through social engineering and was able to download files. Notices identify separate sets of potentially exposed identity and health data.
- Disclosed
- Nov 13, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- People notified by Dexcom about files involved in the employee-account intrusion.
- Data breach · Personal information
- In the wild
- Yes
- Dexcom confirmed unauthorized access through social engineering.
What happened
Dexcom says the attacker was able to download certain files after gaining access to employee accounts. It revoked the compromised accounts’ access and reports no evidence of ongoing unauthorized activity or misuse. The notices give no total affected count. They describe exposure associated with corporate accounts and do not establish compromise of glucose monitors or their software.
The identity-data notice lists possible exposure of names, Social Security numbers, dates of birth and government identification information. The health-data notice lists names, addresses and potentially pharmacy, provider, birth date, prescription or diagnosis information, including whether someone uses Dexcom. That letter excludes Social Security numbers and financial information for its recipients and lists (844) 971-8641 for questions.
Crime-scene timeline
Nov 2, 2026
Dexcom identifies possible exposure
Dexcom investigates with outside specialists and revokes compromised accounts’ access.
Nov 13, 2026
California lists two Dexcom notices
One covers identity data and offers monitoring. The other covers limited health data.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- California Attorney General filingPrimaryLists two company notices under the same incident.
- Dexcom identity-data noticePrimaryDescribes identity fields, containment and two years of Kroll monitoring.
- Dexcom health-data noticePrimaryLists health fields, excludes Social Security and financial data for this group, and gives a support number.