Dexcom data breach letters: employee accounts accessed, SSNs exposed for some and health details for others

Date	Event
November 2, 2026	Dexcom determines recipients' information may have been involved; the California record's breach date
November 13, 2026	Both letter versions posted by the California attorney general

What happened in the Dexcom data breach?

The letters say the intruder used social engineering to get into employee accounts, then downloaded files. Dexcom brought in outside counsel and a cybersecurity firm, and it contained the incident by revoking the compromised accounts' access. The investigation found no evidence of ongoing unauthorized activity. Dexcom then reviewed the downloaded files to find whose information was in them. It says it has reinforced its security awareness training. The letters do not say when the accounts were first accessed, how many accounts were involved, or what kind of social engineering was used. Dexcom describes itself in its quarterly report as a medical device company focused on CGM systems for managing diabetes and metabolic health. Its principal executive offices are in San Diego. The report was filed on October 29, 2026, before the November 2 determination. Social engineering in SEC 8-K filings describes how other companies have reported the same entry route.

What information was exposed in the Dexcom breach?

That depends on which letter you received:

Letter	Information listed	What Dexcom offers
Identity-data letter	Name, Social Security number, date of birth, government identification information	Two years of Kroll identity monitoring
Health-data letter	Name, address, preferred pharmacy, healthcare provider, date of birth, prescription number, certain diagnoses, other limited health information (including being a Dexcom user)	No monitoring offer in the letter

The health-data letter says the incident did not involve those recipients' Social Security numbers, card numbers or other financial information. Both letters say Dexcom has no indication that any information has been misused. The letters do not say whose records each group's were, for example employees or customers.

What is Dexcom offering people who got the letter?

Recipients of the identity-data letter get a two-year Kroll membership at no cost, with credit monitoring, fraud consultation and identity theft restoration. They activate it at enroll.krollmonitoring.com by the deadline printed on the letter. The health-data letter makes no such offer and points to the steps attached to the letter: free credit reports, fraud alerts and security freezes. Both versions give the same helpline. Credit monitoring offers in breach letters compares offers across the log.

How many people were affected by the Dexcom breach?

Not known yet. The California posting gives no number. On November 14, 2026, the Massachusetts, Vermont and Washington lists did not yet carry Dexcom. As of that date, Dexcom's SEC filing list showed no Form 8-K about the incident. This entry will add the count once a regulator records one. The guide to reading a California AG breach notice explains what the posting does and does not show.