On October 10, 2026, the extortion group Redact added DexCom, the San Diego maker of continuous glucose monitors (CGMs), to its leak site. QPulse reports that the group claims to have taken 3.3 TB of data. The claim is not verified. DexCom has made no public statement, and none of the sources reviewed mention a breach notice, regulator filing or state attorney general notification. This is the second time in ten days that DexCom has appeared on an extortion site. On October 1, a leak site attributed to ShinyHunters listed the company alongside O'Reilly Automotive. Three proposed class actions have already been filed over that earlier claim.
What Happened
The record is made up of claims by the attackers and reporting on those claims. In order:
- September 10, 2026: DexCom filed a Form 8-K with the SEC. The section provided covers Item 5.02 (officer and director changes). It contains no cybersecurity incident disclosure. As of this writing, DexCom's only primary-source filing in the record does not mention a breach.
- October 1, 2026: Cybernews and BreachNews reported that ShinyHunters had moved to a new dark web leak site and listed O'Reilly Automotive and DexCom. The group said it would publish data "by end of day Friday" (October 2, per the law firm Levi & Korsinsky's summary) unless the companies contacted it. Both outlets said no proof samples were posted. BreachNews added that the group did not say what data it held, how much, or how it got in.
- October 2, 5 and 6, 2026: OpenClassActions reports that three proposed class actions were filed against DexCom in the U.S. District Court for the Southern District of California. No class has been certified and no court has ruled. Levi & Korsinsky has also opened an investigation.
- October 10, 2026: ThreatMon flagged a new listing for DexCom on Redact's leak site, which Undercode News and Orbitaley then reported. QPulse reported the 3.3 TB figure the same day.
Accounts differ on who is behind the listings. Cybernews, BreachNews and the legal sites credit the October 1 listing to ShinyHunters. Orbitaley describes the same Cybernews coverage as a site "attributed to the ShinyHunters brand" and treats the October 10 claim as the work of Redact. Orbitaley links Redact to UNC6671, a cluster tracked by Google Threat Intelligence. Taken together, the sources do not settle three questions:
- whether the two listings come from one actor or two;
- whether they cover the same data set;
- whether the second listing is a re-post after the October 2 deadline passed.
The descriptions of the attack also conflict. QPulse and Undercode News call it ransomware. Orbitaley reports that Redact/UNC6671 does not encrypt systems and runs data-theft extortion only.
What Was Taken
Nothing has been confirmed.
- Volume: The 3.3 TB figure comes only from QPulse, a lower-tier aggregator, which credits it to the group's claim. Undercode News, citing ThreatMon, says the listing included no sample, no ransom demand and no technical detail. It lists data theft and patient data exposure as "not established." Orbitaley also stresses that the listing does not confirm the scope of any data. The October 1 ShinyHunters listing gave no volume at all, according to BreachNews and Cybernews.
- Infostealer figures: QPulse also cites Hudson Rock and ParanoidLab figures: 29 compromised employees, 4,415 compromised user accounts, 112 compromised third-party employee credentials, 21,200 exposed passwords, 1,686 cookies and 114 external attack surface points. These are general infostealer exposure statistics about DexCom. No other source ties them to this incident, so read them as background risk indicators, not proof of how a breach happened.
- Possible sensitivity: Cybernews notes that DexCom products serve more than 5 million people. If a breach is confirmed, patient health data could be involved. Levi & Korsinsky lists the kinds of data DexCom typically handles: names, health and treatment data, insurance details, contact information and location data. That list is a guess based on DexCom's business, not on any leaked material.
Why It Matters
- Litigation before confirmation. Lawsuits were filed within a day of an unproven, sample-free listing. In healthcare, a leak-site claim alone now brings legal costs and reputational damage, whatever the facts turn out to be. Victims should expect to manage that exposure before forensics are finished.
- Uncertain attribution. The FBI said on September 29 that ShinyHunters and its alleged co-conspirators have breached more than 140 organizations since 2025 and collected at least $70 million in extortion payments. That statement followed the arrest in the Netherlands of an alleged ShinyHunters leader, per BreachNews. Under that pressure, extortion actors are moving infrastructure and switching brands. Google assesses that UNC6671 runs Redact, Pink, Helix and Falcon on shared infrastructure, per Orbitaley. Defenders should track behavior, not brand names.
- No encryption, no outage. If Orbitaley's profile is right, there may be no disruption to notice. The only sign could be data quietly leaving SaaS tenants.
The Attack Technique
No source documents how DexCom was accessed, if it was accessed at all. Two possible paths appear in the sources. Neither is confirmed for this case.
Voice phishing and AiTM (Orbitaley's actor profile). Orbitaley describes UNC6671/Redact's usual method:
- It calls employees, often on personal mobile phones, posing as IT support. Common pretexts include urgent passkey enrollment or a security migration.
- It sends them to adversary-in-the-middle (AiTM) phishing portals that capture credentials and MFA tokens.
- It pulls data from Microsoft 365, Okta or Google Workspace with Python and PowerShell scripts.
- It deletes security alerts to cover its tracks.
- It demands $1 million to $3 million.
The group was active as BlackFile from January 2026. After BlackFile shut down in May, it relaunched as Redact on June 27.
Infostealer credentials (QPulse). QPulse links the incident to infostealer activity based on the Hudson Rock data above. This is a single OTHER-tier source drawing an inference, not a forensic finding.
Both paths end the same way: the attacker obtains valid identities and uses them to access SaaS and identity platforms.
What Organizations Should Do
- Harden the help desk and user verification. Assume attackers will call staff posing as IT. Publish a rule that IT never asks staff to enroll passkeys or "migrate" accounts by phone. Require out-of-band callback verification for any credential or MFA change.
- Use phishing-resistant MFA. Move privileged and SaaS-admin users to FIDO2/passkeys bound to managed devices. Push and OTP factors are exactly what AiTM kits capture.
- Monitor SaaS tenants for bulk exfiltration. Alert on large Graph API, Okta or Workspace exports. Watch for new OAuth grants and for scripted access from unfamiliar ASNs. Treat deletion of security alerts or mailbox rules as a high-severity signal in its own right.
- Act on infostealer exposure. Subscribe to infostealer log monitoring for employee and vendor domains. Force resets and revoke sessions when a hit appears, since stolen cookies get around passwords. Include third-party staff with access to your tenant.
- Prepare a playbook for leak-site claims. Decide in advance who confirms, denies or declines to comment, and on what timeline. DexCom's case shows lawsuits can arrive within 24 hours of an unverified listing.
- Check vendor exposure. If DexCom is in your supply chain or holds your patients' data, ask for written confirmation of its investigation status. Watch for its SEC filings, including any Item 1.05 cybersecurity disclosure.
Sources: DexCom Targeted by Redact Ransomware Group with 3.3 TB of Data Exfi... | DEXCOM INC Form 8-K filed September 10, 2026 | Redact extortion group claims attack on US healthcare company DexCo... | ShinyHunters claims O’Reilly Automotive and Dexcom breaches Cybernews | ShinyHunters Resurfaces With 2 New Extortion Claims | Dexcom Data Breach Lawsuits Over Unconfirmed Hacker Claim | Dexcom, Inc. Breach Lawsuit Investigation | Redact Ransomware Group Claims DexCom as a Victim, Raising Concerns...