AccidentalMisconfigurationCustomer Data InvolvedHEALTH_BASICPIILowContained
DEXCOM, INC.
bd_e429fa4c72ba776f · schema v1 · pii pii-v1
Full breach record for DEXCOM, INC. →Dexcom, Inc. notified Vermont AG that a misconfiguration in its account management system inadvertently shared limited health data (glucose values, insulin doses, device type) with partners after users revoked consent. The error occurred between June 16 and August 14, 2025, and was discovered on August 25, 2025. No names were shared, only tokens. Dexcom applied a software update to revoke consent immediately.
Vermont clock⏱ VT AG >14 bday25 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-09-19-dexcom-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Sep 19, 2025
- Raw hash
- 28a0fdf46e3067bd6d97dc98b4715be1a4949219edde4448a46576cb4278ef50
Reporting entity
- Name
- DEXCOM, INC.norm: dexcom
- Domain
- dexcom.com
Victim entity
- Name
- DEXCOM, INC.norm: dexcom
- Domain
- dexcom.com
Incident
- Discovered
- Aug 25, 2025
- Materiality determined
- —
- Notification sent
- Sep 19, 2025
- Affected individuals
- Not disclosed
- Data types
- HEALTH_BASICPII
- Attack vector
- Misconfiguration
Compliance
- Time to disclose
- 25 days(25 days from discovery to filing)
- Compliance flags
- VT AG >14 bday
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.