Dexcom internal documents accessed after targeted vishing
Dexcom said on October 10, 2026 that targeted vishing events led to unauthorized access to limited information in certain internal documents. It said the incident was contained, with no impact on its products or operations, and that it engaged an outside forensics firm; class actions filed afterward cite a ShinyHunters claim that Dexcom has not confirmed.
- Victim
- Dexcom
- Industry
- Healthcare
- Country
- United States
- Intrusion began
- Not disclosed
- First disclosed
- Oct 10, 2026
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Phone-based social engineering reached internal documents. Call-back verification before any credential or MFA change, and phishing-resistant MFA, make a convincing caller far less useful.
Sources
- Dexcom Cybersecurity update, Dexcom, Oct 10, 2026
- Dexcom class action lawsuits claim ShinyHunters stole health data, Top Class Actions, Oct 28, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
- DoorDash user contact data taken after an employee was socially engineered 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). Dexcom internal documents accessed after targeted vishing. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-dexcom-targeted-vishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.