Redact extortion group claims attack on US healthcare company DexCom
The extortion group Redact, linked to the actor Google Threat Intelligence tracks as UNC6671, posted a claim against US healthcare company DexCom on 10 October 2026. The case matters because this actor uses no ransomware: it breaks in through phone calls impersonating IT support.
What happened
On 10 October 2026, the extortion group known as Redact listed DexCom, a US healthcare company, among its claimed victims. For now this is an assertion by the group itself: a claim is not a verified incident, and it does not by itself confirm the scope of any data allegedly obtained.
Specialist media had already reported a public mention of the case. On 2 October 2026, Cybernews reported that a new extortion site attributed to the ShinyHunters brand listed alleged breaches at O'Reilly and Dexcom. That coverage confirms the existence of the public claim, not the technical facts alleged by the attackers.
Orbitaley does not reproduce or link to any allegedly leaked material.
Who the group is
Redact is one of the extortion brands used by the actor Google Threat Intelligence tracks as UNC6671, active since January 2026 and previously known as BlackFile. After BlackFile's apparent shutdown in May 2026, the group launched Redact on 27 June, claiming the earlier brand had been compromised by an affiliate. Google assesses it to be the same actor, which also runs the Pink, Helix and Falcon brands on shared infrastructure.
The group does not encrypt systems. It calls employees, often on personal mobile phones, posing as IT support with pretexts such as urgent passkey enrolment or security migrations, and directs them to fake sign-in portals using adversary-in-the-middle (AiTM) techniques that capture credentials and MFA tokens. It then exfiltrates data from Microsoft 365, Okta or Google Workspace using Python and PowerShell scripts, deletes security alerts and demands ransoms of between one and three million dollars. Its published victims are in the United States, and in 2026 it remains focused on financial services and law firms.
What organisations can do
The most effective defences against this actor are identity and process controls, not antivirus.
- Train staff and the help desk: no legitimate support team asks by phone to enrol passkeys, approve MFA prompts or enter credentials via a link sent to a personal mobile.
- Define a verified password and MFA reset procedure, with dual identity checks and call-back on a known channel.
- Adopt phishing-resistant MFA (FIDO2/domain-bound passkeys), which neutralises AiTM fake portals.
- Monitor sign-ins from residential proxies and commercial VPNs, and enforce conditional access from managed devices.
- Alert on bulk API or SDK downloads across Microsoft 365, SharePoint, Okta and Google Workspace, and on deletion or tampering with security logs.
- Inventory applications outside SSO, where the attacker typically forces password resets from already compromised accounts.
Sources
About the group: Redact
Get the alerts
Relevant vulnerabilities, notable ransomware victims, new groups and the weekly bulletin, as soon as they are published.
Claims are published by the criminal groups themselves and are unverified until the organisation or the press confirms them. Names of natural persons (sole traders, individual professionals) are anonymised under the GDPR. We never link to leak sites or stolen data. To request the removal or anonymisation of an entry, contact the site administrator.