Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach.
Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health and Hospital Authority system. Through its Denver Health Medicaid Choice plan, it administers Health First Colorado (Medicaid) benefits for members in Denver and three surrounding counties.
The data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics.
According to DHMP’s incident notice (PDF), SquareML notified the health plan administrator on August 14, 2026, that an access key was inadvertently leaked on a publicly accessible website.
“These credentials may have been used to access a database maintained by SquareML containing information about DHMP’s 238,083 members,” DHMP says.
The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database.
“The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes.
The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data.
According to DHMP, the database did not store Social Security numbers or financial information.
“At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes.
In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions.
Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach
Related: iRhythm Data Breach Impacts at Least 360,000 People
Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million
