Dexcom class action claims weak security led to data breach

Donovan Hart filed a class action lawsuit against Dexcom Inc. in the U.S. District Court for the Southern District of California on Oct. 13, 2026.

The lawsuit alleges the glucose monitor maker's weak data security let hackers steal personal and medical information belonging to its customers and employees.

Dexcom makes continuous glucose monitors, which are wearable sensors that help people with diabetes track their blood sugar in real time. The company says it has more than 2.8 million active customers in more than 100 countries.

Dexcom’s privacy notice reportedly tells users the law requires the company to keep their health information private and secure.

ShinyHunters claims responsibility for breach

ShinyHunters claims responsibility for breach

Around Oct. 1, 2026, a cybercriminal group called ShinyHunters announced it hacked Dexcom. The post warned it would publish the data by the end of the day that Friday unless the company reached out.

The proposed class action claims the post shows the group broke into Dexcom’s network and stole its data, which it has published or soon will publish on the dark web.

The stolen data reportedly includes: Names Dates of birth Driver's license numbers Financial information Medical records Health insurance information

Driver's license numbers

Financial information

Health insurance information

Dexcom posted a statement on Oct. 10, 2026, disclosing that voice phishing calls led to unauthorized access to limited information in certain internal documents. The company has not said whether that incident is the one ShinyHunters claimed. It says its products are secure and that it will notify affected people where appropriate.

What security failures does the lawsuit claim?

What security failures does the lawsuit claim?

The complaint blames the breach on Dexcom’s own security gaps, claiming the company did not adequately train employees and fell short of widely used security standards. It also alleges Dexcom violated Health Insurance Portability and Accountability Act of 1996 rules in several ways, from inadequate access controls to a failure to respond to security incidents.

The proposed class action claims Dexcom failed to notify affected people promptly, costing them the chance to protect themselves early.

How the alleged breach affected Hart

How the alleged breach affected Hart

Hart claims he is a former Dexcom customer who gave the company his personal information. He says the breach caused him anxiety, sleep disruption, stress, fear and frustration and that he spent significant time monitoring his accounts for identity theft.

The legal claims against Dexcom

The legal claims against Dexcom

The lawsuit brings four claims: Negligence , which requires companies to take reasonable care Negligence per se , which applies when a company breaks a law meant to protect the public, here the FTC Act, HIPAA and a California medical privacy law Breach of implied contract , which covers an unwritten promise to safeguard the data Unjust enrichment , which applies when a company profits unfairly at someone else's expense

Negligence , which requires companies to take reasonable care

Negligence per se , which applies when a company breaks a law meant to protect the public, here the FTC Act, HIPAA and a California medical privacy law

Breach of implied contract , which covers an unwritten promise to safeguard the data

Unjust enrichment , which applies when a company profits unfairly at someone else's expense

The lawsuit seeks compensatory and punitive damages, restitution, court orders to protect class members' information and attorneys' fees.

What the lawsuit means for Dexcom users

What the lawsuit means for Dexcom users

The proposed class covers every U.S. resident whose private information the alleged October 2026 Dexcom data breach compromised. There is no settlement, no claims process and no money available at this time.