SquareML Data Breach Impacts 238k Individuals

SquareML, a healthcare analytics vendor that supports DHMP operations, experienced a data breach that affected Denver Health Medical Plan (DHMP), a nonprofit health insurance company. The incident may have affected 238,083 DHMP members whose personal and health information was stored in a database maintained by SquareML.

DHMP learned of the issue on Aug. 14, 2026, and publicly announced the incident on Oct. 1, 2026, according to a notice posted on its website.

On June 27, 2025, SquareML inadvertently published an active access key, a type of digital credential used to connect to online databases, on a publicly accessible website, according to the notification. The access key was associated with a database maintained by SquareML that contained personal and health information about DHMP members.

The exposed credentials remained publicly accessible for nearly 14 months before being discovered. The access key was deactivated on Aug. 18, 2026, four days after DHMP was notified of the problem.

The compromised account was read-only. This means the exposed access key could not have been used to download, export, delete or change any information stored in the database.

The types of personally identifiable information in the database included full name, date of birth, city, state, ZIP code and demographic information.

The database also contained protected health information, including health metrics such as BMI, HbA1c (a measure of blood sugar levels over time), eGFR (a measure of kidney function), health plan eligibility data, provider name and hospital admission, discharge and transfer information.

Social Security numbers and financial information were not included in the database.

SquareML's response to the breach

DHMP mailed letters to affected individuals with details about the incident and steps they can take to protect their information.

Individuals who received a letter can refer to it for specific guidance about their situation. A dedicated hotline has been established at 888-766-0023 for individuals with questions related to the incident.