A vendor’s exposed access key led to the Denver Health Medical Plan data breach, discovered in August 2026, affecting 238,083 current and former members. Exposed data included names, demographics, dates of birth, and health plan and treatment details, but not Social Security numbers or financial information. Affected individuals should monitor accounts for unusual activity and watch for phishing attempts referencing their health plan.
| Company | Denver Health Medical Plan |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names, City/State/Zip Code, Demographic Information, Dates of Birth, Health Plan Eligibility Information, Provider Names, Admission/Discharge/Transfer Information, Health Metrics (BMI, HbA1c, eGFR) |
| People Affected | 238,083 individuals |
| Attack Method | Exposed Vendor Access Key |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Denver Health Medical Plan Data Breach?
Denver Health Medical Plan has disclosed a data breach tied to one of its technology vendors. The non-profit health plan, which is affiliated with the Denver Health and Hospital Authority in Colorado, says the incident stemmed from a security lapse at SquareML. SquareML provides an artificial intelligence and machine learning analytics platform used to process plan member data.
According to the health plan, unauthorized access to its network occurred in August 2026, when it learned that an access key belonging to the vendor had been posted on a public website. This key could have let someone reach a database holding plan member information. Notably, the key had actually been exposed since June 2025, meaning it sat publicly visible for more than a year before anyone caught it.
Once Denver Health Medical Plan learned of the exposure, it moved to shut down the risk. The vendor deactivated the access key days after discovery. As a result, the health plan then worked to determine exactly what data the key could have reached and who needed to be notified.
The investigation into this incident focused on whether the key had actually been misused. Denver Health Medical Plan has stated that it found no evidence of misuse so far. However, because the key existed publicly for over a year, the organization chose to notify affected members out of caution.
Who was affected?
This breach affects current and former members of Denver Health Medical Plan. In total, 238,083 individuals had information connected to the exposed vendor database, according to the health plan’s own disclosure.
Because this is a health plan, the affected population likely includes a broad mix of patients, from young children enrolled in family coverage to older adults with long plan histories. The notice does not specify whether minors are included, but health plans commonly cover dependents of all ages.
The scope of this incident is specific to Denver Health Medical Plan’s membership base, which is primarily tied to the Denver, Colorado area. Since the exposure involved a vendor’s database rather than a direct intrusion into the health plan’s own systems, the affected population is defined by whoever had data stored with SquareML at the time.
What Information Was Potentially Exposed?
Denver Health Medical Plan has identified the specific categories of information that were part of the exposed database. Importantly, the organization confirmed that Social Security numbers and financial account information were not involved in this particular incident.
- Full names
- City, state, and zip code
- Demographic information
- Dates of birth
- Health plan eligibility information
- Provider names
- Admission, discharge, and transfer information
- Health metrics such as BMI, HbA1c, and eGFR
Even without Social Security numbers or financial details, this kind of data still carries real risk. For example, dates of birth combined with full names and addresses can help a scammer build a convincing profile for identity theft or targeted phishing attempts.
In addition, the health metrics and admission records included in this breach are sensitive in a different way. This information reveals details about a person’s medical history and ongoing conditions, which could be used in targeted scams that reference real health details to appear legitimate. Because of this, affected individuals should stay alert even though core financial identifiers were not part of this exposure.
What is the company doing?
Denver Health Medical Plan responded by working with SquareML to deactivate the exposed access key once it learned of the issue. The health plan has stated that the key only allowed read-only access, meaning it could not be used to download, export, delete, or alter any data in the database.
Following the investigation, Denver Health Medical Plan mailed notification letters directly to affected individuals, even though the underlying database was maintained by its vendor. This approach let members learn about the incident from the organization holding their health plan relationship, rather than from an unfamiliar third party.
Looking ahead, the health plan will likely need to reassess how it monitors vendor security practices going forward. Because this access key sat exposed for over a year before detection, vendor oversight and faster detection methods are likely areas of continued focus.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Affected individuals should request a copy of their credit report from each of the three major credit bureaus. Reviewing these reports carefully can help spot new accounts or inquiries that you do not recognize.
Because this breach did not include Social Security numbers, the risk of new-account fraud is lower than in many other breaches. Still, periodic credit report checks are a simple, free habit that catches problems early if anything unusual does appear.
Watch for Phishing and Medical-Themed Scams
Given that health plan eligibility details and provider names were exposed, affected individuals should be cautious of messages referencing their health plan or medical visits. Scammers often use real details to make phishing emails or calls seem more believable.
As a result, avoid clicking links or sharing information in unsolicited messages, even if they mention your health plan correctly. Instead, contact Denver Health Medical Plan directly using a phone number from its official website if you want to verify any communication.
Review Insurance and Medical Statements
Because admission, discharge, and provider information was part of this incident, it is worth reviewing any insurance statements or explanation-of-benefits notices closely. This helps you catch any unfamiliar medical services or provider visits tied to your name.
If you notice anything unusual, contact your health plan immediately to flag the discrepancy. Early reporting makes it easier to resolve any mistaken or fraudulent claims before they cause lasting problems.
Consider Consulting a Data Breach Attorney
Given the scale of this breach, affected individuals may want to speak with an attorney who focuses on data breach cases. A free consultation can clarify whether you may be eligible for compensation tied to this incident.
In addition, an attorney can help you understand your legal options and any applicable deadlines. This step costs nothing upfront in most cases and can provide peace of mind about your next moves.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.