DEXCOM, INC.

The West Series of Lockton Companies, LLC, an insurance brokerage providing employee benefit services to Dexcom, Inc., inadvertently disclosed employee personal information to three RFP participants on May 13, 2026. An Excel file sent to solicit proposals for family forming benefits contained Social Security numbers, names, dates of birth, and potentially benefits election data. Access was promptly revoked, and participants confirmed deletion or non-access. Lockton is offering two years of Experian IdentityWorks to affected employees.

West Series of Lockton Companies, LLC reported an inadvertent disclosure of Dexcom employee personal information (names, SSNs, DOB) to RFP participants via an Excel file on April 29, 2026. Access was revoked, and 4 New Hampshire residents were notified on June 12, 2026, with credit monitoring offered. No misuse indicated.

On April 29, 2026, The West Series of Lockton Companies, LLC, an insurance brokerage providing employee benefits to Dexcom, Inc., inadvertently disclosed an Excel file containing Dexcom employees' names, Social Security numbers, dates of birth, and potentially benefits election information to three RFP participants. Access was revoked, and participants confirmed deletion. Lockton provided affected employees with a two-year complimentary Experian IdentityWorks membership.

Dexcom, Inc. notified Vermont AG that a misconfiguration in its account management system inadvertently shared limited health data (glucose values, insulin doses, device type) with partners after users revoked consent. The error occurred between June 16 and August 14, 2025, and was discovered on August 25, 2025. No names were shared, only tokens. Dexcom applied a software update to revoke consent immediately.

Dexcom, Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2025-05-06 and was reported on 2025-06-18. 1 Indiana residents were affected. 23 individuals affected in total.

Dexcom, Inc. (CIK 1595003) filed its 10-K Item 1C disclosing no material cybersecurity incidents in the last three fiscal years. The filing details robust governance, including a Board Technology Committee and a Cybersecurity and Privacy Committee. The company maintains an ISO 27001 certified ISMS, conducts annual phishing tests, and provides employee training on malware, ransomware, and social engineering. No specific breach, data exfiltration, or financial impact was reported.