For: people who received a Dexcom notice of data breach, and users of Dexcom products who want to know whether they are affected. This article is based on Dexcom's own statement and the notices it filed with the California Attorney General, and does not cover attack steps.
Developing: this article will be updated as the organisation publishes more
- Who is affected
people who received a Dexcom notice of data breach, and users of Dexcom products who want to know whether they are affected.
- Confirmed so farSee the table ↓
- Unauthorized access to internal documents
- Documents published on an illicit website
- Dexcom products and operations
1 more
- Credit monitoring offer
Listed as possibly affected
- Name
- Social Security number, date of birth, government ID information
- Address and health information (pharmacy, provider, date of birth, prescription number, certain diagnoses, indication of being a Dexcom user)
- Not yet confirmed
- The number of affected people (not stated by the company or in the filing)
- Which notice goes to which group of people (the notices do not say)
- Whether users outside the United States are affected (not stated)
1 more
- The exact files and data categories involved, beyond the lists in the two sample notices
- What to do nowSee the steps ↓
- Check which data your letter lists
- If your letter lists a Social Security number: activate the monitoring offer and look at your credit reports
- If your letter lists health information: check statements and expect convincing fake contacts
2 more
- Verify any call, text or email about this through a number you look up yourself
- Keep using your devices as before
- Where to verify (source)All sources ↓
- Dexcom, "Dexcom Cybersecurity update" (official statement of October 10, 2026, with the November 12 update; checked November 15)
- Last checked
- As of November 15, 2026
Follow-up plans and what we checked
The company says its investigation is now complete and that it is closing out the incident while continuing to monitor its systems (November 12 statement). It has not said it will publish more. We checked the company page on November 15 and found no statement newer than November 12.
What to do today
Check which data your letter lists
The two sample notices on the California Attorney General's site differ. One lists name, Social Security number, date of birth and government identification information. The other lists name, address and health information that could include preferred pharmacy, healthcare provider, date of birth, prescription number, certain diagnoses and other limited health information. The notices do not say who gets which, so read the list in your own letter. If you did not receive a letter, nothing published says you are affected, but the company has not published a number of people either.
If your letter lists a Social Security number: activate the monitoring offer and look at your credit reports
That notice offers a complimentary two-year membership with credit monitoring, fraud consultation and identity theft restoration through a monitoring-service provider. It says enrolling does not affect your credit score. The credit monitoring requires you to be over 18 with established US credit, a Social Security number in your name and a US residential address, so it may not be usable from outside the United States. Use the website and membership number printed in your letter, and the deadline in your letter (the sample leaves it blank). The notice's own steps are to review your account statements and free credit reports (annualcreditreport.com, 1-877-322-8228 in the US) and, if you suspect misuse, to contact the Federal Trade Commission, local law enforcement or your state attorney general. It also explains fraud alerts and free security freezes with the three US credit bureaus.
If your letter lists health information: check statements and expect convincing fake contacts
That notice says the incident did not involve your Social Security number, credit or debit card numbers or other financial information. It points you to the same steps: review your account statements and credit reports, and report unauthorized charges to your financial institution. Pharmacy, provider and prescription details are the kind of facts a fake caller can use to sound genuine (a general point, not something the company has reported). Do not share a date of birth, a prescription number or a card number with someone who contacted you first.
Verify any call, text or email about this through a number you look up yourself
Dexcom says the incident came from targeted vishing, so phone calls are the route to be careful about. If someone calls about your Dexcom account or prescriptions, hang up and call the company's number from the letter, the website, or your own records. The notices give (844) 971-8641, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding major US holidays.
Keep using your devices as before
The company says its products remain secure and fully operational and that the incident had no impact on its products or operations (October 10 and November 12 statements). Neither statement asks users to change device settings or reset a Dexcom password. Be wary of any message that says otherwise. Our general advice on fake contacts is in What phishing is.
What happened (from Dexcom's statement and notices)
This section follows Dexcom's cybersecurity update page (October 10 statement, November 12 update) and the two sample notices it filed with the California Attorney General. These are the company's own accounts and have not been verified by a third party.
October 10
Dexcom's first statement: it identified a cybersecurity incident that resulted in unauthorized access to limited information from certain internal documents following targeted vishing events. It said it activated its incident response protocols, engaged a cybersecurity forensics firm for an independent investigation and contained the incident, and that there was no impact on its products, operations or ability to serve customers and partners.November 2
The date of the actual unauthorized access has not been published. This is the date the notices give for the company's determination that some of a person's information may have been involved. The California Attorney General's list shows November 2, 2026 as the date of the breach.November 12
Dexcom's update: the incident resulted from targeted vishing attacks that led to unauthorized access to certain internal documents, which were later published on an illicit website. A small fraction of the impacted files contained personal information. The company is notifying affected individuals and, with its investigation complete, is closing out the incident.November 13
Dexcom's report date on the California Attorney General's list, with two sample notices.
- How it happened (the company's words)
- Unauthorized access to certain employee accounts. The investigation determined that an unauthorized third party gained access through social engineering, and was able to download certain files
- Containment
- Revoked the compromised accounts' access. The investigation found no ongoing evidence of unauthorized activity
- Notice 1: information that may have been involved
- One or more of: name, Social Security number, date of birth, government identification information
- Notice 2: information that may have been involved
- Name, address, and health information that could include preferred pharmacy, healthcare provider, date of birth, prescription number, certain diagnoses, and other limited health information such as an indication that you are a Dexcom user
- Not involved (notice 2)
- Social Security number, credit or debit card numbers, other financial information
- Monitoring offer
- Notice 1 only: a complimentary two-year membership, with credit monitoring, fraud consultation and identity theft restoration, through a monitoring-service provider
- Misuse
- The company says it has no indication that any information has been misused
- Contact
- (844) 971-8641, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding major US holidays (both notices)
What is known and what is not
The state as of November 15, 2026. We will update the status column when more is published.
| Item | Content | Status |
|---|---|---|
| Unauthorized access to internal documents | Following targeted vishing; files downloaded (notices) | Confirmed (the company) |
| Documents published on an illicit website | The November 12 statement says the documents were later published | Confirmed (the company) |
| Name | Listed in both notices | Possible (the company: may have been involved) |
| Social Security number, date of birth, government ID information | Listed in notice 1 | Possible (the company: may have been involved) |
| Address and health information (pharmacy, provider, date of birth, prescription number, certain diagnoses, indication of being a Dexcom user) | Listed in notice 2 | Possible (the company: may have been involved) |
| Social Security number, card numbers, other financial information (notice 2) | The incident did not involve them | Not included (the company) |
| Card numbers in notice 1 | Not listed | Not stated |
| Dexcom products and operations | No impact; products secure and fully operational | Confirmed (the company) |
| Misuse of the information | No indication of misuse | Not confirmed (the company) |
| Number of affected people | Not stated | Not stated |
| Who receives notice 1 and who receives notice 2 | Not stated | Not stated |
| Users outside the United States | Not stated | Not stated |
| Credit monitoring offer | Notice 1 only | Confirmed (the company) |
How to read this: the two notices cover different data, and the filing is a sample
The two sample notices are templates filed with a state, with the recipient's name, date and activation deadline left as placeholders. They do not tell you how many people received each one, or whether one person can receive both. Do not assume that a Social Security number was exposed because it appears in one notice, and do not assume that health information is exposed for everyone: each letter says the information may have been involved for the person it is addressed to.
How to read this: the company's account has not been verified by a third party
The statement and notices rest on Dexcom's own investigation, supported by an outside cybersecurity firm whose findings have not been published. The statement that the documents were published on an illicit website is the company's wording. We do not cover claims made by others about the incident.
What can happen when health details and identity numbers are taken
This is what can happen in general, not a statement that it has happened here. The company says it has no indication of misuse.
A Social Security number, date of birth and government ID information together are what someone needs to apply for credit in another person's name, which is why the notice points to credit reports, fraud alerts and security freezes. A pharmacy name, a provider name, a prescription number and a date of birth do not open accounts on their own, but they make a fake call or message sound as if it comes from a pharmacy, clinic or device maker. People may be asked to confirm a prescription, pay a fee or read out a code. Treat any contact that starts with those details and asks you for something as unverified until you check through a number you looked up yourself.
What organizations can learn
The company's own account is that the way in was phone-based social engineering aimed at employees, followed by file downloads. From the facts it published, and as our view rather than an assessment of the company: staff who can reach files containing customers' health or identity data need a way to verify callers that does not depend on the caller (call-back to a known number, a ticket in a system), access to those files should be limited and logged, and old documents containing personal data should not sit in widely reachable places. We do not describe the attack itself.
Sources (public records)
The facts in this article come from the public records below. Attack details are not covered.
- Dexcom, "Dexcom Cybersecurity update" (official statement of October 10, 2026, with the November 12 update; checked November 15) — dexcom.com
- Dexcom, Inc., data breach report page on the California Attorney General's site (date of breach November 2, 2026, reported November 13, 2026; checked November 15) — oag.ca.gov
- Sample notice 1 (name, Social Security number, date of birth, government identification information; monitoring offer; ELN-28926) — oag.ca.gov (PDF)
- Sample notice 2 (name, address, health information; ELN-28930) — oag.ca.gov (PDF)
- California Attorney General, "Search Data Security Breaches" (list entry for Dexcom, Inc.) — oag.ca.gov
Update history
2026-11-15: First version. Based on Dexcom's cybersecurity update page (October 10 statement and November 12 update) and the two sample notices filed with the California Attorney General on November 13. The company's statement and notices are treated as the primary sources. We will update when more is published.
Read next
- Medical data breaches in the US this year: US healthcare data breaches (2026): major cases and how to check a notice
- What to do when an ID number has leaked: Driver's license data leak: what to do
- Fake calls and messages: What phishing is
- Other 2026 incidents: Data breaches and cyberattacks of 2026