Dexcom

Summary

Class-action plaintiffs allege Dexcom was hacked around Oct. 1–5, 2026, compromising consumers' and employees' personal and health information. The plaintiffs attribute the attack to ShinyHunters, which allegedly posted Dexcom's name and a countdown on its dark-web leak site.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Earlier in 2026, Dexcom alerted users after discovering that two lots of Dexcom G7 sensors had been stolen after being set aside as scrap and designated for destruction. The sensors were subsequently resold through unauthorized channels. The later class action complaints concern an unrelated alleged cyberattack against Dexcom. Spr alleges that Dexcom was hacked on or around Oct. 1, 2026, while Slepr’s complaint places the attack on or around Oct. 5. As of the lawsuits’ reporting on Oct. 18, Dexcom had not issued a data-breach notice or publicly confirmed the alleged hack.

A ransomware monitoring group linked the alleged breach to ShinyHunters, a hacking group that the Federal Bureau of Investigation warned about in May 2026. According to Sprull’s complaint, the group posted Dexcom’s name and an apparent countdown on its dark-web leak site. Slepr separately alleges that ShinyHunters claimed responsibility for the attack. The provided material does not identify affected Dexcom systems, describe how the alleged intrusion occurred, or report any technical containment, investigation, or recovery measures announced by the company.

The plaintiffs allege that the compromised information included names, dates of birth, driver’s license numbers, financial information, medical records, and health-insurance information. Slepr states that hackers stole unencrypted files containing personal and health information. Sprull and Slepr are identified as Dexcom consumers and patients, while Loginov is a prospective consumer who allegedly provided Dexcom with personal information while inquiring about its services. The complaints therefore cover individuals who had direct customer or patient relationships with Dexcom as well as a person who sought information about its services.

The plaintiffs allege that the exposure created a heightened and continuing risk of identity theft and fraud because some of the information cannot be changed or made private again. Slepr reports checking her bills and accounts after learning of the alleged breach and expresses concern about the medical information that may have been exposed. Sprull, Slepr, and Loginov also allege that they experienced anxiety, stress, sleep disruption, and fear arising from the incident. The complaints describe both possible financial harm and alleged disclosure of sensitive medical and health-insurance information.

Sprull and Loginov accuse Dexcom of failing to train its employees properly on cybersecurity and of failing to promptly warn affected individuals. Slepr alleges that Dexcom failed to encrypt sensitive data and failed to delete information it no longer needed. The complaints frame these alleged failures as negligence and breaches of implied contracts. Loginov additionally alleges invasion of privacy and breach of fiduciary duty. None of these alleged shortcomings had been adjudicated at the time of the report, and Dexcom had not publicly confirmed the alleged attack or the plaintiffs’ account of its security practices.

By Oct. 18, three nationwide class actions had been filed in the U.S. District Court for the Southern District of California. The cases are Sprull v. Dexcom Inc., Case No. 3:26-cv-05843; Slepr v. Dexcom Inc., Case No. 3:26-cv-05844; and Loginov v. Dexcom Inc., Case No. 3:26-cv-05841. The plaintiffs seek damages and injunctive relief, and Slepr asks the court to require Dexcom to encrypt data and submit to independent security audits. All three plaintiffs have demanded a jury trial. The cases are being handled by lawyers from Milberg PLLC, Kopelowitz Ostrow P.A., and Edelsberg Law P.A.

Sources

Sources available to members: 1 source.