DexCom posted a statement on October 10 saying targeted vishing events led to unauthorized access to limited information from certain internal documents. The company says its investigation found no impact on products, operations or its ability to meet the needs of customers and partners. It activated incident response, brought in an outside forensics firm, contained the access and added safeguards. It has not said how many people are affected, and it has not tied the event to either extortion claim filed against it this month.
Three days later, two proposed class actions landed in the US District Court for the Southern District of California. Slepr v. Dexcom, Inc. (3:26-cv-05844) was filed October 13 on diversity jurisdiction with a breach of contract cause of action. Hart v. Dexcom, Inc. (3:26-cv-05851) was filed the same day and pleads negligence, negligence per se, breach of implied contract and unjust enrichment.
The Hart complaint points at the ShinyHunters post from around October 1 as evidence the group entered DexCom's network and took data. It alleges the exposed fields include names, dates of birth, driver's license numbers, financial information, medical records and health insurance information. The negligence per se count leans on the FTC Act, HIPAA and California medical privacy law. The proposed class covers every US resident whose private information was compromised. DexCom reports more than 2.8 million active customers in over 100 countries, which is a customer count, not a victim count.
Look at what the pleadings did with a disclosure this thin. DexCom described internal documents rather than patient records, and it never confirmed the ShinyHunters claim, yet both suits were on file inside 72 hours. If an incident statement says limited information without naming the fields, plaintiffs' counsel will name them from the extortion post instead, and the gap between claim and disclosure becomes an allegation of delayed notification.