The Denver Health Medical Plan breach: what the SquareML key exposed, and what to do
For fourteen months a vendor’s access key sat on a public website, and it opened the health records of 238,083 plan members. No Social Security numbers, no sign anyone used it. Here is what that means for you and what is worth doing.
SquareML, an analytics vendor for Denver Health Medical Plan, left a read-only access key on a public website from 27 June 2025 until 18 August 2026. It could reach the names, dates of birth, ZIP codes, provider names, hospital admission records and health measurements of 238,083 members. Social Security numbers and financial details were not included, and the plan says there is no evidence anyone looked. There is no online lookup; the letter is the answer. Members should read their explanation-of-benefits statements and treat calls about the breach with suspicion.
What is confirmed, and what is still open
The middle column is what Denver Health Medical Plan has said. The right column adds detail from breach trackers and notes what the plan has not said.
| Question | What the plan says | Detail and open questions |
|---|---|---|
| What went wrong | SquareML, a healthcare analytics vendor working for the plan, put an active access key on a public website on 27 June 2025. The key opened a database holding member data. | The plan has not said which website, or whether anyone besides the person who reported it found the key. |
| How long it was out | About 14 months. SquareML told the plan on 14 August 2026, and the key was switched off on 18 August 2026. | Nothing disputed about the dates. |
| How many people | 238,083 current and former members of Denver Health Medical Plan. | Claim Depot lists the filing with the federal HHS breach portal on 1 October 2026. |
| What it could reach | Names, dates of birth, city, state and ZIP code, demographic details, plan eligibility, provider names, hospital admission, discharge and transfer records, and health measurements. | Breach-tracking sites list the measurements as BMI, HbA1c (blood sugar) and eGFR (kidney function). |
| What it could not reach | The plan says Social Security numbers and financial account information were not in the data. | The key was read-only: it could not be used to download, export, delete or change records. |
| Misuse | The plan says it has no evidence member information was viewed or misused, only that it could have been. | Law-firm and claim sites began advertising investigations on 26 October 2026. No lawsuit outcome or settlement exists. |
Sources: Denver Health Medical Plan’s news release on the SquareML incident (October 2026) as reported by SecurityWeek (27 October 2026); Claim Depot and other breach trackers (26 October 2026). Status as of 4 November 2026.
1. What happened, in order
Denver Health Medical Plan, the health plan run by Denver’s public hospital system, sends member data to an analytics vendor called SquareML. On 27 June 2025 SquareML put an access key for that data on a public website by mistake. Nobody noticed for more than a year. On 14 August 2026 SquareML told the plan the key had been found, and it was switched off four days later. Passwords on every account with access to the database were reset. The plan published a notice in early October 2026 and started writing to members.
2. “Exposed” here is not the same as “stolen”
Most breach letters describe a break-in where files were copied out. This one is different. The key was read-only, the plan says it could not be used to download or export records, and so far there is no sign anyone used it. That is the good news. The bad news is the length of time: fourteen months is a long window, and nobody can prove a negative. Treat it as a moderate risk, not an emergency, and do the few things below that match the kind of data involved.
3. The honest answer to “am I in it”
There is no lookup. The data has not appeared in the known breach databases that email checkers search. If you were a Denver Health Medical Plan member, current or former, assume you may be among the 238,083 and watch for the letter. If you are unsure, call the plan on the number on your member card.
4. Read your explanation-of-benefits statements
The data includes which providers you see and when you were admitted to hospital. That is what someone needs to bill for care in your name or to sound like your doctor’s office on the phone. For the next few months, read every explanation-of-benefits statement from the plan and look for visits, equipment or prescriptions you never had. Report anything you do not recognise to the plan straight away. Our guide to medical data breaches covers medical identity theft in more detail.
5. The calls and messages that come next
A breach that makes the news brings its own scams. Expect calls claiming to be from Denver Health, SquareML or a “breach settlement office”, messages offering to sign you up for compensation, and texts asking you to confirm your member ID. A caller who knows your date of birth and your doctor’s name is not proof of anything; that is exactly what was in the data. Hang up and call the plan back on a number you already have. Our guide to telling a real breach letter from a fake shows what a genuine notice looks like.
6. What else is worth doing
A free credit freeze at Equifax, Experian and TransUnion is cheap insurance, even though Social Security numbers were not involved. Do not pay anyone who offers to “file your claim” in the Denver Health breach; there is nothing to file yet. And remember that your name, date of birth and ZIP code were already easy to find before this happened, because people-search sites publish them openly.
Your name, birthday and ZIP code are probably public already
You cannot search the SquareML database. You can search the people-search sites that list your home address, phone number and relatives, which is where a scammer who knows your doctor’s name goes next. PersProtect looks for your details on those sites, checks your email against known breach databases, and files the removals.
Check my exposure — free →The Denver Health breach, answered
I got a letter from Denver Health Medical Plan about SquareML. Is it real?
Probably, but check it before acting on anything in it. The plan says it is mailing letters to the 238,083 affected members, and it published a news release about the SquareML incident in early October 2026. A real letter explains what happened and gives a phone number. Compare that number with the one on the back of your member ID card or on the plan’s own website. If the letter, or a call or email about it, asks you to pay something or read out your Social Security number, it is not from the plan.
What is SquareML?
A healthcare analytics company. Health plans send it member data so it can build reports and models, for example on which members need follow-up care. Members usually never hear the vendor’s name until a letter mentions it, which is why many people searching for SquareML have no idea how it got their data.
Was my Social Security number exposed?
According to the plan, no. Social Security numbers and financial account details were not in the data the key could reach. What was there is identity and health information: your name, date of birth, ZIP code, which providers you see, hospital stays and some lab measurements.
Can I check online whether I was in the Denver Health breach?
No. Nothing from this incident has turned up in the known breach databases that email checkers search, and the records were not tied to email addresses in the first place. The letter is the answer. If you were a Denver Health Medical Plan member at any point up to August 2026 and did not get one, call the plan and ask.
Should I freeze my credit?
It is free and does no harm, but the risk here is mostly not new credit accounts, because Social Security numbers were not involved. The likelier problems are scam calls that sound official because the caller knows your doctor or a recent hospital stay, and medical identity theft. Reading your explanation-of-benefits statements matters more for this breach than a credit freeze.
Is there a Denver Health Medical Plan class action?
Not one you can join yet. Law firms and claim sites started advertising investigations at the end of October 2026, which means they are looking for clients. You do not need to sign up with anyone to keep your rights. If a settlement is reached later, eligible members are notified and can file a claim then.
The key is switched off. Your public profile is not.
See which people-search sites publish your address, phone number and relatives. It is free and takes about a minute.
Run my free exposure scan →