Dexcom Class Action Lawsuits 2026, ShinyHunters Data Breach Claims, Exposed Health Information and What Users Need to Know

Dexcom, Inc., the maker of continuous glucose monitoring systems, is facing multiple proposed class actions alleging it failed to protect customers’ personal and health information after the hacking group ShinyHunters claimed it had stolen company data. Three of the lawsuits, all filed October 13, 2026 in the U.S. District Court for the Southern District of California, are Spruell v. Dexcom, Inc., No. 3:26-cv-05843, Slepr v. Dexcom, Inc., No. 3:26-cv-05844, and Loginov v. Dexcom, Inc., No. 3:26-cv-05841.

These are allegations in complaints. Dexcom has not been found liable, no class has been certified, and as of October 19, 2026 there is no settlement, claim form or claim deadline.

What Dexcom Has Officially Confirmed

• A cybersecurity incident occurred. In a statement posted October 10, 2026, Dexcom said voice-phishing (vishing) calls led to unauthorized access to limited information in certain internal documents.
• Its response. The company said it activated its incident-response procedures, hired an independent cybersecurity forensics firm, contained the incident and added security measures.
• Its products. The company said the incident did not affect its products, operations or ability to meet customer and partner needs.
• Notification. It said it will notify affected people where appropriate.

What Dexcom has not publicly confirmed: that ShinyHunters is behind this incident, how many people were affected, exactly which data fields were involved, or that glucose readings, medical records or any specific patient’s data were stolen. It also had not issued a formal data breach notice in the reporting available as of October 19. The claims about stolen health data come from the plaintiffs and from the hackers’ own posts.

Dexcom Data Breach Lawsuits: Quick Facts

Detail	Information
Company	Dexcom, Inc.; reports say it has over 2.8 million active customers in more than 100 countries
Cases covered	Spruell (3:26-cv-05843), Slepr (3:26-cv-05844), Loginov (3:26-cv-05841)
Court	U.S. District Court, Southern District of California
Filing date	October 13, 2026
Judges (Spruell docket)	Judge Robert S. Huie; Magistrate Judge Allison H. Goddard
Alleged hackers	ShinyHunters (claim not confirmed by Dexcom)
Alleged incident dates	On or around October 1, 2026 (Spruell); on or around October 5, 2026 (Slepr)
Dexcom statement	October 10, 2026
Alleged data	Names, dates of birth, driver’s license numbers, financial, medical and health insurance information (per the complaints)
Confirmed number affected	Not publicly disclosed
Reported claims	Negligence and breach of implied contract; Loginov also alleges invasion of privacy and breach of fiduciary duty
Plaintiffs’ counsel	John J. Nelson (Milberg PLLC); Kristen Lake Cardoso (Kopelowitz Ostrow P.A.); Scott Edelsberg (Edelsberg Law P.A.)
Class certification	None
Settlement or claim form	None; no money is currently available to claim

1. What Happened in the Dexcom Incident?

ShinyHunters, an extortion-focused group tied to several large data-theft campaigns, listed Dexcom on its leak site in early October 2026, reportedly with a countdown and without public proof samples. The group’s claim has not been independently confirmed. Dexcom then disclosed a cybersecurity incident on October 10, attributing it to targeted vishing.

What is vishing?

Vishing is phishing by phone. An attacker may impersonate IT staff, an executive or a trusted vendor to persuade an employee to reveal credentials or approve access. Dexcom has not publicly detailed how the attacks happened or which systems were reached.

Did ShinyHunters steal Dexcom patients’ health records?

Unconfirmed. Slepr alleges unencrypted files containing personal and health information were taken, and Spruell and Loginov say names, dates of birth, driver’s license numbers, financial information, medical records and health insurance information may have been compromised. Dexcom’s statement describes access to limited information in internal documents, not a confirmed theft of a patient database. Unauthorized access to internal business documents is not necessarily the same as theft of patient records.

How many people were affected?

Not disclosed. A large customer base does not mean every user was involved, and the number of lawsuits is not the number of victims. A breach notice, if one is sent, would give the clearest account for a given person.

2. The Three Dexcom Lawsuits Explained

Spruell v. Dexcom, Inc., No. 3:26-cv-05843

Lee Spruell, a former Dexcom consumer, alleges the incident occurred around October 1, 2026 and that a ransomware-monitoring group tied it to ShinyHunters, which allegedly posted Dexcom’s name and a countdown on its leak site. He alleges Dexcom did not train employees on cybersecurity and did not warn affected people promptly. Counsel: John J. Nelson, Milberg PLLC. Claims: negligence and breach of implied contract. He seeks damages and injunctive relief and demands a jury trial.

Slepr v. Dexcom, Inc., No. 3:26-cv-05844

Amanda Slepr, a patient and customer, puts the attack around October 5, 2026 and says ShinyHunters claimed responsibility. She alleges Dexcom failed to encrypt sensitive data or delete information it no longer needed. She describes anxiety, sleep disruption and worry about what medical information was revealed. Counsel: Kristen Lake Cardoso, Kopelowitz Ostrow P.A. She asks for orders requiring encryption and independent security audits, plus damages and a jury trial.

Loginov v. Dexcom, Inc., No. 3:26-cv-05841

Yuriy Loginov describes himself as a prospective consumer who gave Dexcom information when asking about its services. He alleges negligence, breach of implied contract, invasion of privacy and breach of fiduciary duty. A company receiving information from someone who inquires does not automatically create a fiduciary relationship, so that claim will face a high bar. Counsel: Scott Edelsberg, Edelsberg Law P.A.

Other Dexcom lawsuits

These are not the only cases. Hart v. Dexcom, Inc., No. 3:26-cv-05851, was filed in the same court on October 13, 2026 by Donovan Hart, a former customer, represented by Emery Reddy, PLLC. It alleges negligence, negligence per se (based on the FTC Act, HIPAA and a California medical privacy law), breach of implied contract and unjust enrichment. Other reports said at least nine proposed class actions had been filed by October 14, with other named plaintiffs including Richard Lovell and Mark Allen Hunter. Each complaint must be read separately because plaintiffs, claims and class definitions differ. No consolidation had been reported.

3. The Law Behind the Dexcom Data Breach Cases

Negligence

A plaintiff must show a duty to use reasonable care in protecting information, a breach of that duty, causation and damages. The plaintiffs argue a company holding sensitive customer information should use reasonable security controls, train employees to resist social-engineering attacks, limit access and respond promptly. Dexcom’s reported response steps are relevant, but an incident alone does not establish negligence. A court would examine security measures before the incident, foreseeable risks, how access occurred and whether any failure caused the harm. Defendants often invoke California’s economic-loss rule against purely financial negligence claims.

Breach of implied contract

The theory is that by giving a service provider personal information, a consumer reasonably expected it to be protected. The differing relationships (former consumer, patient, prospective customer) matter to whether an implied promise existed.

California Confidentiality of Medical Information Act (CMIA)

The CMIA, Cal. Civ. Code § 56 and following, restricts disclosure of medical information and requires providers and certain other entities to maintain and preserve its confidentiality (see § 56.101 on negligent handling). Section 56.36 provides a private right of action, including nominal damages of $1,000 per patient without proof of actual damages, for qualifying violations. Whether Dexcom is covered by the Act for the data at issue, and whether information was actually viewed by an unauthorized person, would be contested. Hart’s complaint reportedly relies on a California medical privacy law.

California Consumer Privacy Act (CCPA)

Cal. Civ. Code § 1798.150 gives California consumers a private right of action when nonencrypted and nonredacted personal information of specified types is accessed and exfiltrated, stolen or disclosed because a business failed to maintain reasonable security. Statutory damages are $100 to $750 per consumer per incident, or actual damages if greater, after a 30-day notice and cure process for statutory damages. Section 1798.145(c) exempts medical information governed by the CMIA and HIPAA from much of the CCPA, so the type of data matters. The three cases should not be described as CCPA cases unless a complaint pleads that claim.

California reasonable-security and breach-notice laws

• Cal. Civ. Code § 1798.81.5: requires businesses that own or license California residents’ personal information to maintain reasonable security procedures.
• Cal. Civ. Code § 1798.82: requires notice to affected California residents in the most expedient time possible and without unreasonable delay when qualifying unencrypted personal information is, or is reasonably believed to have been, acquired by an unauthorized person. A sample of a notice involving more than 500 California residents must be submitted to the California Attorney General. The statute does not require the same notice for every incident, and application depends on the data and the facts.
• Other states: every state has a breach-notification law, so notice duties can also arise for residents elsewhere.

California Unfair Competition Law and CLRA

Plaintiffs in data breach cases often add claims under the Unfair Competition Law (Cal. Bus. & Prof. Code § 17200) and the Consumers Legal Remedies Act (Cal. Civ. Code § 1750 and following). The reported complaints in these three cases focus on negligence and contract, but later complaints could add them.

Does HIPAA let patients sue?

No private right of action. HIPAA applies to covered entities (health plans, clearinghouses and certain providers) and business associates. Its Breach Notification Rule (45 C.F.R. §§ 164.400 to 164.414) generally requires notice without unreasonable delay and no later than 60 days after discovery. Enforcement is by the Department of Health and Human Services and state attorneys general, and courts have held individuals cannot sue directly under HIPAA (see Acara v. Banks, 470 F.3d 569 (5th Cir. 2006)). Plaintiffs instead use HIPAA as evidence of a standard of care, for example in negligence per se theories. Whether a device maker or any particular Dexcom service is a HIPAA covered entity or business associate depends on its role, and that cannot be assumed across all customer accounts and company records.

FTC Act and Health Breach Notification Rule

Section 5 of the FTC Act, 15 U.S.C. § 45, prohibits unfair or deceptive practices, and the FTC has used it against companies with inadequate data security. The FTC’s Health Breach Notification Rule, 16 C.F.R. Part 318, covers certain vendors of personal health records and related entities not covered by HIPAA. Whether any Dexcom service and the data involved fall within it requires legal and factual analysis, and the rule does not itself give consumers a damages action. The FTC Act also provides no private right of action.

FDA device cybersecurity law

Section 524B of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. § 360n-2) requires cybersecurity measures for certain “cyber devices.” That law concerns devices and their security, and these lawsuits concern the alleged exposure of information from company documents, so it should not be treated as automatically applicable here.

Federal jurisdiction, standing and class rules

• Jurisdiction: the dockets identify diversity jurisdiction under 28 U.S.C. § 1332. Putative class actions can also qualify under the Class Action Fairness Act, 28 U.S.C. § 1332(d).
• Standing: a federal plaintiff must show a concrete injury (TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)). In the Ninth Circuit, a credible risk of identity theft can be enough in some data cases (Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010); In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018)). Because Dexcom has not confirmed that any specific data was stolen, standing and what was actually taken are likely early battlegrounds.
• Consolidation: cases in the same court can be consolidated under Fed. R. Civ. P. 42(a), and related cases in different courts can be centralized by the Judicial Panel on Multidistrict Litigation under 28 U.S.C. § 1407.
• Class certification: Fed. R. Civ. P. 23 requires numerosity, commonality, typicality and adequacy under 23(a), plus predominance and superiority for a damages class under 23(b)(3).

Criminal law against the attackers

Unauthorized access to computers is a federal crime under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. That statute concerns the hackers’ conduct, not Dexcom’s liability.

4. Can Users Recover Money for Anxiety or Risk of Identity Theft?

The complaints describe anxiety, sleep disruption, time spent monitoring accounts and fear of identity theft. Courts treat such harms differently. Evidence that can strengthen a claim includes a breach notice showing the plaintiff’s data was involved, records of unauthorized charges or fraud, expenses incurred responding to the incident, evidence of actual misuse, and facts showing a concrete risk of future harm. The absence of proven identity theft does not necessarily end every claim, but a generalized fear may not support every form of relief.

5. What Are the Plaintiffs Seeking?

Remedy	What it could mean
Actual damages	Compensation for losses the plaintiff proves
Restitution	Return of money or benefits where retention is legally improper
Nominal damages	A small award where a violation is shown without substantial loss, if the claim allows
Injunctive relief	Orders such as encryption and independent security audits
Attorneys’ fees and costs	Where authorized by statute, contract or other basis
Punitive damages	Possible under certain claims if standards are met
Statutory damages	Possible under statutes such as the CMIA or the CCPA, if pleaded and proven

These are possible remedies, not awards. There is no approved damages formula or payment amount.

6. Are Dexcom Devices Affected?

Dexcom says the incident did not affect its products or operations. The lawsuits concern the alleged exposure of information, not malfunctioning sensors or altered glucose readings. Patients should not stop using prescribed monitoring equipment because of a data-breach lawsuit. If you have concerns about your glucose-monitoring plan, contact your health care professional and follow official manufacturer safety notices.

This incident is also different from an earlier, separate Dexcom issue involving two lots of G7 sensors that had been set aside as scrap but were stolen and resold through unauthorized channels, which concerned physical products rather than the October 2026 incident.

7. What Defenses Could Dexcom Raise?

Dexcom has not been reported to have filed a response, so these are potential issues, not confirmed positions.

• No confirmed theft or injury. The company has confirmed limited access to internal documents, not exfiltration of patient records, which bears on standing and damages.
• Reasonable security and prompt response. Its forensic investigation, containment and added safeguards.
• Causation. Whether any harm to a particular plaintiff was caused by this incident rather than other breaches or events.
• Legal-theory challenges. The economic-loss rule, the absence of an implied contract or fiduciary relationship, and the lack of a private right of action under HIPAA.
• Class issues. Different plaintiff relationships and data involved, and whether common issues predominate.
• Arbitration or terms of use. Whether any customer terms require arbitration or limit class claims, a common issue in consumer-technology cases.

8. What Should Dexcom Users Do Now?

Because the scope has not been disclosed, take steps that are reasonable regardless of whether you end up in a class.

• Watch for official notices. Check email and mail from Dexcom and keep any notice, which may show what data was involved.
• Beware of follow-up scams. Incidents lead to impersonation and fake “compensation” messages. Do not give credentials or payment information in response to unsolicited contacts, and go to Dexcom’s official website directly.
• Review accounts and insurance statements. Look for unfamiliar transactions, insurance claims and explanation-of-benefits notices you do not recognize.
• Consider credit protection if identifying data was exposed. If an official notice or reliable evidence shows Social Security numbers, financial account data or similar identity data was involved, a fraud alert or credit freeze may be appropriate. Do not assume every Dexcom user needs one.
• Keep records. Save notices, suspicious messages, statements, fraud reports and receipts for protective measures.

9. Can You Join the Dexcom Class Actions?

Not yet. The lawsuits are proposed class actions, and no court has certified a class or fixed a definition. Owning a device or having an account does not automatically make you a class member, and a breach notice, if received, could be important evidence but is not decided as a requirement. No claim deadline, claims administrator or compensation fund exists, so be wary of websites claiming an approved Dexcom settlement payment is available.

10. What Happens Next?

Date	Event
On or around October 1, 2026	Alleged hack (Spruell); ShinyHunters leak-site listing reported around this time
On or around October 5, 2026	Alleged attack date (Slepr)
October 10, 2026	Dexcom posts its cybersecurity statement
October 13, 2026	Spruell, Slepr, Loginov and Hart complaints filed
TBD	Service, any consolidation, Dexcom’s response, any class certification ruling

Likely steps are service, a possible consolidation of overlapping cases, Dexcom’s response (often a motion to dismiss), discovery into security policies, incident-response records and forensic findings, a motion for class certification, then settlement talks or trial. A motion to dismiss would not decide what happened in the incident, and letting claims proceed would not prove liability. The most important facts will be what was accessed, whether health or identifying data was taken, how many people were affected and what security was in place beforehand.

Frequently Asked Questions About the Dexcom Class Action Lawsuits

Is there a Dexcom data breach class action lawsuit in 2026?

Yes. Several proposed class actions have been filed in the Southern District of California. This article covers Spruell, Slepr and Loginov, all filed October 13, 2026, and notes Hart and others.

Did ShinyHunters steal Dexcom patients’ health data?

The group claimed it obtained company data, and plaintiffs allege personal and health information may have been compromised. Dexcom confirmed unauthorized access to limited information in certain internal documents but has not publicly confirmed theft of any specific patient’s data.

What has Dexcom officially confirmed?

A cybersecurity incident following vishing attacks, containment, an independent forensic investigation and added security measures, plus a statement that its products and operations were not affected.

How many people were affected?

Not publicly disclosed.

Is my Dexcom device still safe to use?

Dexcom says its products were not affected. Follow official safety notices and your clinician’s advice.

Does HIPAA mean Dexcom must pay affected users?

No. HIPAA does not give individuals a private right to sue, and whether it applies to particular Dexcom activities depends on Dexcom’s legal role. Other laws and state-law claims may matter.

How much could users receive?

Nothing has been awarded. The plaintiffs seek damages and injunctive relief, and any payment would depend on a judgment or an approved settlement.

Can I join if I only contacted Dexcom?

Loginov’s proposed class reportedly includes people who provided information while inquiring about Dexcom’s services. Whether any person qualifies depends on the eventual class definition and evidence.

Who represents the plaintiffs?

John J. Nelson of Milberg PLLC (Spruell), Kristen Lake Cardoso of Kopelowitz Ostrow P.A. (Slepr) and Scott Edelsberg of Edelsberg Law P.A. (Loginov).

Has Dexcom admitted negligence?

No. It acknowledged an incident and described its response but has not admitted legal negligence.

Editorial Note and Disclaimer

This article discusses allegations in pending proposed class actions, not proven facts or findings of liability. The number of affected people and the information accessed remain unconfirmed. It is general information, not legal advice, and statutory summaries are in plain language and may change. Details may change as the dockets develop. Consult a licensed attorney about your own situation. Corrections are welcome.

Sources

1. Top Class Actions, Dexcom class action lawsuits claim ShinyHunters stole health data, October 18, 2026: https://topclassactions.com/lawsuit-settlements/lawsuit-news/dexcom-class-action-lawsuits-claim-shinyhunters-stole-health-data/
2. Dexcom, Official Cybersecurity Update, October 10, 2026: https://www.dexcom.com/en-us/cyberupdate
3. Justia, Spruell v. Dexcom, Inc., No. 3:26-cv-05843 (S.D. Cal.): https://dockets.justia.com/docket/california/casdce/3%3A2026cv05843/874531
4. Justia, Slepr v. Dexcom, Inc., No. 3:26-cv-05844 (S.D. Cal.): https://dockets.justia.com/docket/california/casdce/3%3A2026cv05844/874539
5. Justia, Loginov v. Dexcom, Inc., No. 3:26-cv-05841 (S.D. Cal.): https://dockets.justia.com/docket/california/casdce/3%3A2026cv05841/874523
6. Claim Depot, Dexcom class action claims weak security led to data breach, October 16, 2026: https://www.claimdepot.com/cases/dexcom-hit-with-class-action-over-alleged-data-breach-exposing-health-records
7. Class Action Pulse, Dexcom data breach lawsuits (2026): https://www.classactionpulse.com/settlements/dexcom-data-breach-lawsuit
8. Cybernews, ShinyHunters claims O’Reilly and Dexcom breaches after FBI clash: https://cybernews.com/news/shinyhunters-oreilly-auto-dexcom-breach-fbi-hack/
9. Federal Rule of Civil Procedure 23: https://www.law.cornell.edu/rules/frcp/rule_23
10. HHS, Covered Entities and Business Associates under HIPAA: https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
11. FTC, Complying with the Health Breach Notification Rule: https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0
12. California Civil Code § 1798.82: https://law.justia.com/codes/california/code-civ/division-3/part-4/title-1-81/section-1798-82/
13. California Civil Code § 1798.150: https://law.justia.com/codes/california/code-civ/division-3/part-4/title-1-81/section-1798-150/
14. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021): https://supreme.justia.com/cases/federal/us/594/20-297/
15. Cal. Civ. Code §§ 56 and following (CMIA), 1798.81.5, 1798.145 and 1750 and following; Cal. Bus. & Prof. Code § 17200; 45 C.F.R. §§ 164.400 to 164.414; 16 C.F.R. Part 318; 15 U.S.C. § 45; 21 U.S.C. § 360n-2; 18 U.S.C. § 1030; 28 U.S.C. §§ 1332 and 1407; Fed. R. Civ. P. 42.
16. Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010); In re Zappos.com, Inc., 888 F.3d 1020 (9th Cir. 2018); Acara v. Banks, 470 F.3d 569 (5th Cir. 2006).