Dexcom says targeted vishing calls led to access to internal documents

Dexcom, the continuous glucose monitor maker, published a statement on October 10 saying that "targeted vishing events" led to unauthorized access to limited information contained in certain internal documents. The company says it activated its incident response protocols, engaged an outside cybersecurity forensics firm for an independent investigation, and has contained the incident. It reports no impact on its products, its operations, or its ability to serve customers and partners, and says it has added further safeguards to its systems and processes. Dexcom has not named the systems involved, said what kind of information was in the documents, or said whether patient data was among it. It says it will notify affected individuals where appropriate. Dexcom has not attributed the attack to any group.

Why it matters

Vishing against employees works because a phone call can talk someone into approving a sign-in, resetting a factor, or reading out a code, and none of that trips a technical control. The defenses are procedural and cryptographic: call-back verification through a known number before any credential or MFA change, as covered in the help desk social engineering brief, and phishing-resistant MFA so that a code read over the phone is useless. Check recent MFA resets and new device registrations for staff with access to document stores.

Update, October 28, 2026: At least three proposed class actions have been filed against Dexcom in the U.S. District Court for the Southern District of California (Spruell, Slepr and Loginov), alleging negligence and breach of implied contract, according to Top Class Actions. One complaint says ShinyHunters claimed responsibility. Dexcom has not confirmed that claim, and its statement had not changed as of October 28.

Source: Dexcom