Police Take Down Three Malware Networks, and Dexcom Reports a Data Breach

Sunday, November 15, 2026 · 3:11 episode

This is Scams and Breaches Daily, a weekday briefing on consumer scam alerts and data-breach notices, with one concrete action.

Europol says an international operation took down servers behind the Gootloader, CastleRAT, and StealC malware, and that more than 6 million stolen victim credentials were found on the criminals' infrastructure. The U.S. Justice Department announced its part of the Gootloader action the same day. Dexcom reported a breach to the California Attorney General on November 13 after an outsider reached certain employee accounts. Have I Been Pwned has added the CastleRAT victim data, so you can check whether your email address is in it.

Official alert: Operation Endgame takes down Gootloader, CastleRAT, and StealC

On Thursday, November 12, 2026, Europol announced that law enforcement and private partners had dismantled infrastructure behind three malware tools, Gootloader, CastleRAT, and StealC, as part of Operation Endgame. Europol says 235 servers and 257 domains were seized or taken down, and that over 6 million victim credentials were identified in the seized criminal infrastructure. The suspects, Europol says, sold those credentials for use in later attacks such as ransomware.

The same day, the Justice Department announced that Gootloader had been removed from over 100 servers, including compromised WordPress sites, and that U.S. domains used to deliver and control it were seized. According to the department, Gootloader has infected at least 25,000 computers worldwide since 2018, often by tricking people into downloading it. Infected computers were added to a botnet, and access to them was sold to ransomware actors. The department says Gootloader was used in ransomware attacks on at least 44 U.S.-based victims, with about $28.8 million in losses.

Europol describes how each tool worked. Gootloader spread as fake legal documents posted on compromised websites, often hacked WordPress sites, and people who downloaded those documents were infected. CastleRAT is a remote access trojan that lets attackers control an infected computer from a distance. StealC was built to pull passwords, stored access data, and digital identities from infected computers for data trading and fraud.

Breach notice: Dexcom

On Friday, November 13, 2026, Dexcom, Inc. appeared on the California Attorney General's public data-breach list, with a breach date of November 2, 2026. The submitted notification page includes two sample letters.

In both letters, Dexcom says that on November 2, 2026, it determined that some people's information may have been involved in unauthorized access to certain employee accounts. An unauthorized third party got in through social engineering and was able to download certain files. Dexcom says it revoked the compromised accounts' access and has no indication that any of the information has been misused.

In one version of the letter, the information that may have been involved includes name, Social Security number, date of birth, and government identification information. Dexcom offers a complimentary two-year membership with Kroll that includes credit monitoring, fraud consultation, and identity theft restoration. Activation is at enroll.krollmonitoring.com, using the membership number and deadline printed in the letter.
In the other version, it includes name, address, and health information that could include preferred pharmacy, health care provider, date of birth, prescription number, certain diagnoses, and other limited health information, such as an indication that the person is a Dexcom user. That letter says Social Security numbers, credit or debit card numbers, and other financial information were not involved.

Questions go to (844) 971-8641, Monday through Friday, 9 a.m. to 6:30 p.m. Eastern Time (8 a.m. to 5:30 p.m. Central Time, as the letters state), excluding major U.S. holidays. The letters also point to free credit reports at AnnualCreditReport.com, and the FTC's identity-theft help is at IdentityTheft.gov.

One action: check Have I Been Pwned for the CastleRAT data

On Friday, November 13, 2026, Have I Been Pwned added a CastleRAT record: 179,745 email addresses, provided by Europol, that are associated with CastleRAT infections, along with 893,000 unique passwords seen more than 3 million times on infected computers. The passwords are searchable in Pwned Passwords.

Enter your email address at haveibeenpwned.com. If it appears in the CastleRAT record, the site recommends changing that password on every account where you used it and turning on two-factor authentication wherever it is offered. Europol also urges WordPress users to update their credentials, enable multi-factor authentication, and patch vulnerabilities.

Sources

That's Scams and Breaches Daily. Links to every source are in this episode's description, in the list above. For all of it in your inbox, sign up for the free daily email at scamsandbreachesdaily.com/subscribe.