Denver Health Medical Plan, the nonprofit health plan of the Denver Health system, has told the public that a vendor’s access key was exposed online and may have opened a database holding information about its 238,083 members. Here is what the plan has disclosed so far, and what it has not.
Denver Health Medical Plan’s Data Breach Investigation
Denver Health Medical Plan, often shortened to DHMP, is a nonprofit health plan serving the Denver area. Like many plans, it works with outside companies that analyze member data. One of them is SquareML, a healthcare analytics vendor that supports DHMP operations, and that relationship is at the center of this incident.
According to the plan’s public statement, issued on October 1, 2026, DHMP was informed on August 14, 2026 that an active access key associated with SquareML had been discovered on a publicly accessible website. DHMP says those credentials may have been used to reach a database maintained by SquareML that contained information about DHMP’s 238,083 members. The statement adds that SquareML inadvertently published the credentials on June 27, 2025, and that the key was deactivated on August 18, 2026.
Put those dates side by side and the scale of the exposure window becomes clear. The key sat on a public website for more than a year before the plan was told, and it remained active for several days after DHMP learned of it. During that entire stretch, anyone who found the credentials could have tried to use them. The plan has not said who found the key, how it was found, or whether anyone actually used it.
DHMP describes the compromised account as read-only, meaning the access key could not be used to download, export, delete or change information. The plan also states that it has no evidence member information was viewed or misused, only that it may have been. Those are the plan’s own characterizations, and the public statement does not say whether SquareML’s access records for the period have been reviewed or what they showed.
Once DHMP learned of the situation, it says it launched an internal investigation and worked with SquareML to secure the affected data. The public key was voided, passwords were reset for every account with access to the database, and DHMP says it is evaluating additional remedial actions with the vendor. The plan reports that it is following all required reporting procedures under the Health Insurance Portability and Accountability Act, known as HIPAA, and that it has mailed letters to affected individuals. A dedicated hotline was set up to answer questions about the incident.
This kind of incident is a reminder of how health data actually moves. A health plan may protect its own systems carefully, yet still depend on analytics vendors that hold copies of member records in separate cloud environments. When a vendor mishandles a credential, such as leaving an access key in a place the public can read, the plan’s own defenses matter little, because the key is a ready-made way in. Across the industry, credentials left in public code repositories and websites are a well-known source of exposure, and automated tools scan for them constantly.
Healthcare is also a frequent target because the data is detailed and long-lived. A person can replace a stolen credit card in a day, but a date of birth, a hospital admission history, and clinical measurements stay attached to a person indefinitely. The combination of identity details with health information can be used for targeted scams, for example a caller who knows your plan, your provider, and your recent hospital stay and claims to be following up on a bill.
Several questions remain unanswered in the public record. The plan has not said whether it can confirm that no one accessed the database, whether it is offering credit monitoring or identity protection, or what changes SquareML has made to keep credentials from being published again. Because the notice describes a possibility of access rather than a confirmed theft, affected members have little way to judge their own risk without more detail from DHMP and its vendor.
If you are a DHMP member, or you received a letter about this incident, keep the notice, note the date you received it, and treat any unexpected contact that references your health plan or medical care with caution. The sections below walk through the timeline, the information involved, and the steps you can take now.
When Did This Breach Occur?
The timeline in the plan’s statement spans more than a year. SquareML inadvertently published the access key on June 27, 2025. DHMP was informed that the key had been found on a publicly accessible website on August 14, 2026, and the key was deactivated on August 18, 2026.
DHMP issued its public statement on October 1, 2026, and says it has mailed letters to affected individuals. Because the plan describes only the possibility that the credentials were used, it has not identified a date on which any member’s information was actually viewed.
Anyone who was a DHMP member during that period, and who has received a letter or is unsure whether they are covered, should keep the dates above in mind when reviewing their own records and any mail from the plan.
What Information Was Breached?
DHMP says the database contained a member’s full name, date of birth, city, state, ZIP code, and demographic information. It also held health metrics, including BMI, HbA1c and eGFR, along with health plan eligibility data, provider names, and hospital admission, discharge and transfer information.
The plan states that Social Security numbers and financial information were not included in this database. That limits some risks, such as new-account fraud built on a Social Security number, but the health and identity details that were included are sensitive in their own right.
What the plan has not said is how many of the members had each type of information in the database. Members who received a letter should read it closely, since it is the best source for what applies to them.
What You Can Do
Read any letter from DHMP carefully and keep it. Questions about the incident can be directed to the dedicated hotline the plan has established, which is listed in the plan’s statement on its website.
Review the explanation of benefits statements your plan sends, and check them for services or providers you do not recognize. Contact the plan right away if anything looks wrong.
Be skeptical of calls, texts and emails that mention your health plan, your doctor or a recent hospital visit. Do not give out personal details to someone who contacted you first, and verify the request by calling the number printed on your member ID card.
Consider placing a fraud alert or a free credit freeze with the credit bureaus, even though Social Security numbers were reportedly not in the database. A freeze costs nothing and can be lifted when you need to apply for credit.
File a Data Breach Lawsuit Against Denver Health Medical Plan
Data breaches that expose health information can give rise to legal claims, particularly when a company or its vendor is alleged to have failed to protect sensitive records. Whether a particular claim is viable depends on facts that are still emerging, including how the access key came to be published and whether any member’s information was actually accessed.
If you are a Denver Health Medical Plan member, you may be able to take part in a class action lawsuit over this incident. A lawyer can explain what options might be available to you based on your own circumstances.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
