ShinyHunters added DexCom to its leak site on October 1, alongside auto parts retailer O'Reilly, after a stretch during which the extortion group's own site had gone dark. The listing gave DexCom until October 2 to make contact or see unspecified data published. No sample ever went up, and the fields behind whatever the group claims to hold stayed unstated. DexCom did not respond to a request for comment from Cybernews, which first reported the listing.
Nine days later, a separate group calling itself Redact posted its own claim against DexCom on the tracking site Ransomware.live, saying it had carried out a ransomware attack that disrupted the company's US operations. That post, logged October 10, named no ransom figure, no deadline, and no stolen data set. Two extortion claims against the same manufacturer in the same month, from two unrelated actors, and neither comes with proof.
The ShinyHunters listing landed amid the group's public feud with federal investigators. ShinyHunters says it hacked the FBI's systems on September 22. Dutch police had already arrested Pepijn van der Stap on September 15, and the FBI announced on September 29 that it considers him an alleged leader of the group. ShinyHunters' leak site disappeared within hours of that announcement. The group denies any connection, blaming infrastructure upgrades and a rival's denial of service campaign instead, and resurfaced two days later with the DexCom and O'Reilly listings.
DexCom makes the G7, ONE+, and Stelo continuous glucose monitors, used by more than 5 million people who pair the sensors with a smartphone app to track blood sugar in real time. The company reported $4.6 billion in 2025 revenue. A confirmed breach touching that app infrastructure would put diabetes management data in the exposure column alongside contact records, the detail that separates this claim from a retailer's.
Nothing here is confirmed. DexCom's own public status page logged only two short service interruptions on October 1, in user registration and photo upload, both resolved within hours and never described as security related. Treat two unconfirmed claims in one month as a prompt to pressure test your own incident response plan for when an extortion group names you without proof, because neither claim yet clears the bar for an actual breach notification.