Denver Health Medical Plan Data Breach Impacts 238,000+ Individuals

Denver Health Medical Plan, a nonprofit health insurance company serving the Denver area in Colorado, disclosed a data breach involving its healthcare analytics vendor, SquareML. The breach affected 238,083 individuals in the United States.

The breach was reported to the U.S. Department of Health and Human Services on Oct. 1, 2026. The company also posted a notice on its website with details about the incident.

On June 27, 2025, SquareML inadvertently published an active access key on a publicly accessible website. These credentials could have been used to access a database maintained by SquareML that contained information about Denver Health Medical Plan members.

The exposed credentials remained publicly available for nearly 14 months. On Aug. 14, 2026, Denver Health Medical Plan learned that the access key had been discovered on the public website. The access key was deactivated four days later on Aug. 18, 2026.

The compromised account was read-only, meaning the access key could not have been used to download, export, delete or change any information in the database.

The types of personally identifiable information (PII) that may have been exposed included full names, dates of birth, cities, states, ZIP codes and demographic information.

The protected health information (PHI) that may have been exposed included health metrics such as BMI, HbA1c and eGFR, as well as health plan eligibility data, provider names and hospital admission, discharge and transfer information.

According to official disclosures, Social Security numbers and financial information were not included in the affected database.

Denver Health Medical Plan's response to the breach

Denver Health Medical Plan is evaluating additional remedial actions with the vendor. Denver Health Medical Plan has mailed letters to affected individuals with details about the incident and steps they can take to protect their information.

Individuals with questions related to the incident may reach out to the dedicated hotline that has been established at 888-766-0023.