What to Do After the Dexcom Data Breach (2026)

What Happened in the Dexcom Data Breach

Dexcom, the San Diego maker of continuous glucose monitors (CGMs), says that on November 2, 2026 it determined that an unauthorized third party had gained access to certain employee accounts through social engineering, meaning staff were manipulated into handing over access rather than systems being hacked through a software flaw. With that access the attacker downloaded files. Dexcom revoked the compromised accounts, brought in outside counsel and a cybersecurity firm, and says it found no ongoing unauthorized activity and no indication so far that anyone's information has been misused.

Dexcom reported the incident to the California Attorney General on November 13, 2026 and began mailing notices. It has not published how many people are affected.

The disclosure comes about six weeks after the extortion group ShinyHunters listed Dexcom on its leak site in early October 2026 and claimed to have taken company data. Dexcom never publicly confirmed that claim, and the group posted no samples. Between October 2 and October 14, eight proposed class actions were filed against Dexcom in federal court in San Diego. Dexcom's notice does not mention ShinyHunters, so whether the October claim and the November notice describe the same intrusion has not been confirmed.

What Data Was Exposed

Dexcom filed two different notice letters, so what you need to do depends on which one you got. Read the "What Information Was Involved?" paragraph of yours.

Is the Dexcom Breach Letter Legit?

Yes, if it matches the sample notices Dexcom filed with the California Attorney General (oag.ca.gov, Dexcom, Inc., breach date November 2, 2026). Genuine letters come from Kroll's mailing address, cite a membership number on the identity version, and list the incident helpline (844) 971-8641, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time. Enrollment happens only at enroll.krollmonitoring.com. Kroll is a real breach-response firm; our review of whether Kroll monitoring is legit covers what it does and does not do.

Be wary of any email or text that claims to be your Dexcom notice. The official notice arrives by mail, and Dexcom will not ask you to confirm your SSN or pay a fee.

What to Do Now

1. 1

   Step 1 of 6: Work Out Which Letter You Have

   If your letter lists your Social Security number or government ID, follow every step below. If it lists only health information, steps 2 and 3 are optional, but steps 4 to 6 are essential.

2. 2

   Step 2 of 6: Activate the Free Kroll Monitoring

   The identity letter includes two years of Kroll single-bureau credit monitoring, fraud consultation and identity theft restoration. Activate it at enroll.krollmonitoring.com with the membership number printed on your letter before the deadline on the letter. It does not affect your credit score.

3. 3

   Step 3 of 6: Freeze Your Credit at All Three Bureaus

   Kroll's monitoring only tells you after someone applies for credit in your name. A freeze stops new accounts from being opened at all, it is free, and it takes about 15 minutes. Follow our guide to freezing your credit at Equifax, Experian and TransUnion, and see what else to do when your Social Security number is leaked, including getting an IRS Identity Protection PIN to block fraudulent tax returns.

4. 4

   Step 4 of 6: Watch for Medical Identity Theft

   Prescription numbers and diagnoses can be used to bill insurers for devices and supplies you never received. Review every Explanation of Benefits statement from your health insurer, report claims you do not recognize, and read our guide to protecting yourself from medical identity theft.

5. 5

   Step 5 of 6: Treat Dexcom-Themed Calls and Messages as Suspect

   Do not act on unsolicited calls or messages about Dexcom sensors, refunds, recalls or your breach claim. Hang up and call Dexcom, your pharmacy or your insurer on a number you look up yourself. Never read out a one-time code or log in through a link in a text. Keep your Dexcom app account on a unique password with two-factor authentication turned on.

6. 6

   Step 6 of 6: Remove the Rest of Your Profile From Data Brokers

   Breached records become far more dangerous when criminals combine them with what people-search sites already publish about you: your phone number, current address, relatives and age. Removing those listings makes it harder to build a convincing scam or open accounts in your name. PrivacyOn removes your information from 100+ data broker sites, monitors the dark web for your SSN and email, re-checks 24/7 for re-listings, and covers up to 5 family members from $8.33/month. It is a natural complement to the Kroll offer, and you can see how it compares in our roundup of the best data removal services.

   Check Your Exposure for Free

   Run a free PrivacyOn scan to see which data brokers are publishing your name, address and phone number right now. No credit card required.

Dexcom Class Action Lawsuits

Eight proposed class actions were filed in the U.S. District Court for the Southern District of California in October 2026, before Dexcom's notice. The complaints allege negligence and breach of implied contract, among other claims, and seek damages and security improvements. As of mid-November 2026 there is no settlement, claim form or deadline. You do not need to hire a lawyer or sign up anywhere to be included in a future class settlement; keep your notice letter and records of any fraud or time spent dealing with it. Our guide on filing a data breach settlement claim explains how the process works when one opens.

Frequently Asked Questions