Dexcom Faces Class Action Over Alleged Data Breach by ShinyHunters Dexcom, a leading manufacturer of continuous glucose monitors with over 2.8 million users worldwide, is the target of a class action lawsuit filed on October 13, 2026, in the U.S. District Court for the Southern District of California. The suit, brought by plaintiff Donovan Hart, alleges the company’s inadequate data security enabled hackers to steal sensitive personal and medical information. The breach was claimed by the cybercriminal group ShinyHunters, which announced on October 1, 2026, that it had compromised Dexcom’s network and threatened to publish the stolen data unless contacted. The exposed information reportedly includes names, dates of birth, driver’s license numbers, financial details, medical records, and health insurance data. Dexcom acknowledged a separate incident on October 10, 2026, involving voice phishing calls that led to unauthorized access to internal documents but did not confirm whether this was the breach ShinyHunters referenced. The company stated its products remain secure and that affected individuals would be notified as needed. The lawsuit alleges multiple security failures, including inadequate employee training, substandard access controls, and delayed incident response, which it claims violate HIPAA, the FTC Act, and California medical privacy laws. Hart, a former Dexcom customer, asserts the breach caused anxiety, stress, and time spent monitoring for identity theft. The legal claims include negligence, negligence per se, breach of implied contract, and unjust enrichment, with demands for compensatory and punitive damages, restitution, and court orders to protect affected users. The proposed class covers all U.S. residents whose data was compromised in the October 2026 breach, though no settlement or claims process has been established.

ShinyHunters Denies FBI Link to Dark Web Downtime, Reveals New Victims The cybercrime group ShinyHunters has clarified that recent disruptions to its dark web leak site were due to infrastructure upgrades following a DDoS attack by rival hackers not an FBI investigation. In a statement to Straight Arrow, a group representative confirmed the site was taken offline for maintenance, dismissing any connection to its recent breach of the FBI. Despite the outage, ShinyHunters has resurfaced on a new dark web domain, featuring enhanced DDoS protections and a revamped captcha system. The updated site lists O’Reilly Automotive and DexCom, Inc. as its latest victims. The group’s downtime followed its high-profile breach of the FBI’s jobs website, where it exfiltrated 2–3 terabytes of sensitive data on nearly all FBI employees and applicants. The stolen information includes names, Social Security numbers, addresses, badge numbers, and personal details of agents, applicants, and their spouses. A sample of the data, shared with media outlets, revealed details on agents involved in counterintelligence, cyber operations, and drug cartel investigations, raising national security concerns. ShinyHunters claimed the attack was retaliation for an FBI public service announcement in May, which accused the group of exaggerating data access for extortion. The hackers denied the allegations and stated they never intended to publish the full dataset, despite earlier threats. The FBI has prioritized the investigation, confirming ongoing efforts to mitigate the breach and notify affected individuals. In a separate development, Dutch authorities arrested a 24-year-old alleged ShinyHunters member, though the FBI did not link the arrest to the jobs site breach. FBI Cyber Division Assistant Director Brett Leatherman later issued a video statement urging remaining group members to surrender, warning that arrests and seized infrastructure could expose their identities.