Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach.
Based in Denver, Colorado, DHMP is a nonprofit managed care agency within the Denver Health and Hospital System. Through the Denver Health Medicaid Choice Plan, it administers Health First Colorado (Medicaid) benefits for members in the city of Denver and the surrounding tri-county.
The data breach, DHMP said, involved third-party vendor SquareML, which provides a code-free platform for healthcare analytics.
According to DHMP’s Notification of the event (PDF), SquareML notified health plan administrators on August 14, 2026, that access keys were inadvertently leaked on a publicly accessible website.
“These credentials may be used to access a database maintained by SquareML containing information about DHMP’s 238,083 members,” DHMP said.
The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it can be used to access personal data and health information stored in the database.
“The compromised account is read-only, meaning the access code cannot be used to download, export, delete, or change any data,” DHMP notes.
Information that may be compromised includes name, date of birth, ZIP code, city, state, demographic information, health metrics, health plan eligibility information, hospital admissions, provider names, and flow and transfer information.
According to DHMP, the database does not store social security numbers or financial information.
“At this time, DHMP does not have any evidence that member information has been viewed or misused, only that it may be,” the Alliance of Health Plans notes.
In response to the incident, passwords for all accounts accessing the database have been reset, and DHMP and SquareML are working on additional fixes.
Related: Quest Diagnostics data breach exposes ‘certain patient records’
Related: 970,000 Medi-Cal members affected by Paradigm Healthcare data breach
Related: The iRhythm data breach affected at least 360,000 people
Related: Oracle health data breach rises to nearly 20 million
