Denver Health Medical Plan says a SquareML access key left on a public website for more than a year may have exposed personal and health data for 238,083 members. The key was read-only; the plan says it has no evidence of viewing or misuse.
What Denver Health Medical Plan confirmed
In a 1 October 2026 statement (opens in a new tab), Denver Health Medical Plan (DHMP) said SquareML, a healthcare analytics vendor that supports its operations, notified the plan on 14 August 2026 that an active access key had been found on a publicly accessible website. Those credentials “may have been used to access a database maintained by SquareML containing information about DHMP’s 238,083 members.”
SquareML had published the credentials on 27 June 2025. The key was deactivated on 18 August 2026, leaving a window of roughly 417 days. DHMP describes the compromised account as read-only: the key could not download, export, delete or change records. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the statement says.
What was in the database
According to DHMP, the SquareML database held full names, dates of birth, city, state and ZIP code, demographic information, health metrics including BMI, HbA1c and eGFR, health-plan eligibility data, provider names, and hospital admission, discharge and transfer information. Social Security numbers and financial information were not in the database.
DHMP is a non-profit managed care organisation within the Denver Health and Hospital Authority system. Through Denver Health Medicaid Choice it administers Health First Colorado (Medicaid) benefits in Denver and surrounding counties, as summarised by SecurityWeek (opens in a new tab) and HIPAA Journal (opens in a new tab). The incident appears on the US Department of Health and Human Services OCR breach portal (opens in a new tab) as a Hacking/IT Incident affecting 238,083 individuals, submitted 1 October 2026.
Response and what members should do
DHMP says it launched an internal investigation with SquareML, voided the public read-only key, reset passwords for every account with database access, and is evaluating further remedial steps with the vendor. It says it is following required HIPAA reporting procedures. Letters have been mailed to affected individuals, and a dedicated hotline, 888-766-0023, is open for questions.
- Members: treat unsolicited calls or emails that quote health metrics, eligibility details or hospital stay dates as high-risk. Use the published hotline, not numbers in unexpected messages.
- Health plans and BA partners: inventory every vendor key that can read PHI analytics stores, how those keys are issued, and how long a leaked credential would stay live.
- Defenders: watch for phishing that recycles BMI, HbA1c, eGFR or ADT fields named in the notice; those details make a fake “plan adviser” sound legitimate.
Sources
- Denver Health Medical Plan — Statement regarding privacy incident (opens in a new tab) (1 October 2026; PDF)
- SecurityWeek — Vendor key leak puts data of 238,000 Denver Health Plan members at risk (opens in a new tab) (27 October 2026)
- HIPAA Journal — Denver Health Medical Plan discloses vendor breach affecting 238K members (opens in a new tab) (26 October 2026)
- HHS OCR breach portal (opens in a new tab) (Denver Health Medical Plan, 238,083 individuals, submission dated 1 October 2026)
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)