An extortion crew that calls itself Redact has added DexCom, the company behind the continuous glucose monitors used by millions of people with diabetes, to its leak site. The listing appeared on October 10 and tags the firm as medical equipment with about $4.97B in revenue.
DexCom builds the G6 and G7 sensors that stream real-time blood sugar readings to pumps and phones, and its hardware sits inside clinical workflows at hospitals, endocrinology practices, and diabetes clinics. A leak-site claim does not prove data was taken, but for a device maker the exposure risk reaches beyond billing records into connected-device and patient-monitoring data.
Redact is one of the newer names in the double-extortion economy, posting victims across healthcare, manufacturing, and professional services. The group did not publish a sample file set with the DexCom entry, so the volume and contents of any stolen material remain unconfirmed.
For healthcare security teams the claim is a reminder that medical device vendors are now treated as first-class targets. A compromise at a sensor maker can ripple into every hospital that depends on its cloud platform for glucose telemetry, so vendor risk assessments should cover device makers the same way they cover EHR and billing vendors.
DexCom had not issued a public statement at the time of writing. Organizations running DexCom integrations should confirm whether their instances share credentials or network paths with the vendor and review their own monitoring for unusual access to glucose data feeds.
