Dexcom glucose monitor users may be covered by eight proposed class actions alleging DexCom, Inc. failed to protect personal and health information that the extortion group ShinyHunters claimed in October 2026 to have taken. Dexcom has not confirmed a breach, no class has been certified and there is nothing to file yet.
Hacker Claim · Not Confirmed by Dexcom · No Settlement
This page describes class action complaints and an extortion group's public claim. Dexcom has not confirmed that a breach occurred, the statements below are unproven allegations, and DexCom, Inc. has not been found liable. There is no certified class and nothing to claim at this time. This page is informational and is not legal advice.
What Happened at Dexcom?
Around the start of October 2026, the extortion group ShinyHunters added DexCom, Inc., the San Diego maker of continuous glucose monitors, to its data-leak website and claimed to have taken company data. The group listed O'Reilly Automotive at the same time and threatened to publish files from both companies if they did not contact it. Cybernews, which reported on the listings, said the group posted no sample files and that Dexcom did not respond to a request for comment. Straight Arrow News reported on October 1 that a new version of the group's leak site listed both companies as its latest victims.Two days later, on October 3, the threat-intelligence account Dark Web Informer reported on X that ShinyHunters had removed Dexcom and O'Reilly Automotive from the site. OCA could not independently verify that report, and Dexcom has not commented on it. A removal, if it happened, would not show whether data was taken or what became of it.
Dexcom has not confirmed or denied the claim. As of October 15, 2026, OCA found no breach notice or state attorney general filing from Dexcom, and the company has made no public statement about the listing. That means there is no official account of whether anything was taken, what it was, or how many people it involved.
Eight proposed class actions have been filed anyway, all in the U.S. District Court for the Southern District of California, where Dexcom is headquartered: three between October 2 and October 6, and five more on October 13 and 14, 2026. No court has ruled on any of the allegations.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What's New: Five More Lawsuits
Five more proposed class actions were filed against Dexcom in the same court on October 13 and 14, 2026, bringing the total to eight. Only one of the five complaints, No. 3:26-cv-05851, is available on the public docket; the other four had not been posted publicly as of October 15. That complaint is described below with the earlier ones.On October 14, the court transferred the second-filed case, No. 3:26-cv-05699, to the judge handling the first-filed case, No. 3:26-cv-05668, under its low-number rule, which sends a related case to the judge who has the lowest-numbered one. Notices of related case have been filed in three of the cases. The eight cases were assigned to six different district judges when they were filed, and the court had not consolidated them as of October 15.
Dexcom's position has not changed: the company still has not publicly confirmed or denied a breach.
The Eight Dexcom Lawsuits
All eight cases are in the U.S. District Court for the Southern District of California. A plaintiff's home state is given where the complaint is public.- No. 3:26-cv-05668 — filed October 2, 2026. The first-filed case; its complaint is not on the public docket.
- No. 3:26-cv-05699 — filed October 5, 2026. Indiana plaintiff. Transferred on October 14 to the judge in No. 3:26-cv-05668 under the low-number rule.
- No. 3:26-cv-05727 — filed October 6, 2026. Oregon plaintiff, with a proposed Oregon subclass.
- No. 3:26-cv-05841 — filed October 13, 2026. Complaint not on the public docket.
- No. 3:26-cv-05843 — filed October 13, 2026. Complaint not on the public docket.
- No. 3:26-cv-05844 — filed October 13, 2026. Complaint not on the public docket.
- No. 3:26-cv-05851 — filed October 13, 2026 and docketed October 14. California plaintiff; the proposed class includes Dexcom consumers and employees.
- No. 3:26-cv-05878 — filed October 14, 2026. A notice of related case has been filed; the complaint is not on the public docket.
What the Lawsuits Allege
Three of the eight complaints are available on the public docket. They say Dexcom collected sensitive personal and health information from people who use its glucose monitors, apps and support services, and failed to protect it. All three cite the Cybernews report on the ShinyHunters listing as a source for the breach claim, plead much of their account on information and belief rather than from any Dexcom disclosure, and acknowledge that the details are not yet known. The Indiana complaint says the number of people affected is unclear and that Dexcom had not disclosed the breach as of filing; the Oregon complaint says the specific records and fields involved would have to be established through Dexcom's own records in the case.The complaints describe the data differently. The Indiana complaint and the California complaint both allege, on information and belief, that it included names, dates of birth, driver's license numbers, financial information, medical records and health insurance information; the California complaint says those types of information "may have been compromised." The Oregon complaint describes account and demographic information linked to glucose readings, device use, technical-support requests and sensor replacements. None of those lists comes from Dexcom.
The Oregon plaintiff says he has used Dexcom's monitors since about 2013, currently uses a G7, shares his readings with his doctors through Dexcom Clarity and with the Tidepool app, and has repeatedly given Dexcom personal and medical information when asking for technical help and replacement sensors.
The California complaint, No. 3:26-cv-05851, was brought by a former user of Dexcom's devices. It describes Dexcom as having more than 2.8 million active customers globally, citing the company's website, and proposes a class that reaches Dexcom employees as well as consumers. It points to a Dark Web Informer post on X and the Cybernews report as the source of the breach claim, which it dates to on or around October 1, 2026. Its class definition refers to a breach "discovered by Dexcom, Inc. in October 2026" and to people who "received notice" of it, and one paragraph states that Dexcom "has admitted" the information was lost; OCA found no breach notices and no public statement from Dexcom admitting or denying a breach.
Legal Claims and What the Lawsuits Seek
The Indiana complaint brings claims for negligence, negligence per se, unjust enrichment, breach of implied contract and breach of confidence. The Oregon complaint pleads negligence, breach of implied contract and unjust enrichment alongside state-law claims under California's Confidentiality of Medical Information Act, the privacy clause of the California Constitution, Oregon's Unlawful Trade Practices Act and Oregon's law of breach of confidence, with a proposed Oregon subclass. The California complaint pleads negligence, negligence per se, breach of implied contract and unjust enrichment, basing its negligence per se claim on Section 5 of the Federal Trade Commission Act and also alleging that Dexcom fell short of HIPAA safeguards.All three propose a nationwide class of people whose information was compromised in the alleged breach. They ask for damages, statutory damages where available, restitution, and court orders requiring Dexcom to improve how it protects the information it holds; the California complaint also asks for punitive damages and for Dexcom to pay what it calls inequitable proceeds into a common fund. Those are requests, not amounts anyone has been awarded.
Why the Breach Claim Matters
Lawsuits filed off an attacker's listing, before any company notice, face a specific problem. A data breach complaint normally relies on the company's own notification letter to show that a particular person's information was taken. Without one, the plaintiffs have to persuade the court that their own data was involved, which is harder when the attacker has posted nothing.ShinyHunters' record cuts both ways. Some of its listings have been confirmed by the companies involved, while others have proved smaller than claimed. OCA's coverage of the Carhartt data breach shows how a ShinyHunters dataset can turn out to be padded with synthetic records, and the DentaQuest data breach lawsuits show the opposite path, a listing followed by a company-confirmed count.
If Dexcom's data were taken, the stakes would be high. Glucose readings, device records and support histories are health information, and a continuous glucose monitor account ties that information to a named person over years of use.
What Happens Next
The next significant fact is likely to come from Dexcom or from ShinyHunters, not from the court. A company statement or breach notices would establish whether data was taken and whose, and a publication of files by the group would show what it holds. Either would reshape the complaints.On the court side, eight overlapping suits in the same district are commonly consolidated before one judge, and the low-number transfer has already put the first two cases before the same judge. A consolidated case would usually proceed on a single amended complaint, and Dexcom would then respond, often with a motion to dismiss. There is nothing to file in these cases now. This page will be updated if Dexcom confirms or denies the claim, or if the cases are consolidated.
Questions
Has Dexcom confirmed a data breach?
No. As of October 15, 2026, Dexcom had not publicly confirmed or denied the claim made by the extortion group ShinyHunters, and OCA found no breach notices or state attorney general filings from the company. The lawsuits rest on the group's leak-site listing and news reports about it.
Is there a Dexcom data breach settlement or claim form?
No. Eight proposed class actions have been filed in the U.S. District Court for the Southern District of California, but all are at the complaint stage. No class has been certified, there is no settlement, and there is nothing to claim.
What Dexcom data do the lawsuits say was taken?
Two of the three complaints on the public docket allege, on information and belief, that the data included names, dates of birth, driver's license numbers, financial information, medical records and health insurance information. The third describes account and demographic information linked to glucose readings, device use and technical-support records. None of those lists comes from Dexcom, and Cybernews reported that ShinyHunters posted no sample files.
Who is ShinyHunters?
ShinyHunters is an extortion group that steals data from companies and threatens to publish it unless it is paid. Its listings have sometimes been confirmed and sometimes overstated, so a listing on its leak site is a claim, not proof of what was taken.
Did ShinyHunters take Dexcom off its leak site?
A threat-intelligence account, Dark Web Informer, reported on X on October 3, 2026 that ShinyHunters had removed Dexcom and O'Reilly Automotive from its leak site. OCA could not independently verify the report, and Dexcom has not commented on it. A removal would not by itself show whether data was taken or what happened to it.
Why are there several Dexcom lawsuits?
Different law firms filed eight separate complaints between October 2 and October 14, 2026. Notices of related case have been filed in three of the cases, and one has been transferred to the judge handling the first-filed case under the court's low-number rule. Overlapping cases in the same federal district are commonly consolidated before one judge and proceed as a single case, but no consolidation order had been entered as of October 15, 2026.
Sources
• No. 3:26-cv-05668 (S.D. Cal., filed October 2, 2026) — CourtListener docket• No. 3:26-cv-05699 (S.D. Cal., filed October 5, 2026) — CourtListener docket
• No. 3:26-cv-05727 (S.D. Cal., filed October 6, 2026) — CourtListener docket
• No. 3:26-cv-05841 (S.D. Cal., filed October 13, 2026) — CourtListener docket
• No. 3:26-cv-05843 (S.D. Cal., filed October 13, 2026) — CourtListener docket
• No. 3:26-cv-05844 (S.D. Cal., filed October 13, 2026) — CourtListener docket
• No. 3:26-cv-05851 (S.D. Cal., filed October 13, 2026) — CourtListener docket
• No. 3:26-cv-05878 (S.D. Cal., filed October 14, 2026) — CourtListener docket
• Cybernews — "ShinyHunters resurfaces with O’Reilly Auto Parts, Dexcom breach claims after FBI hack showdown"
• Straight Arrow News — "Hunted by FBI, ShinyHunters hackers deny website disruption related to investigation" (October 1, 2026)
• Dark Web Informer on X — post reporting the removal of Dexcom and O’Reilly Automotive from the ShinyHunters leak site (October 3, 2026)
