The facts

  1. DHMP said SquareML published the key on 27 June 2025. The plan learned of it on 14 August 2026, and it was deactivated on 18 August. [1][2]

  2. Potentially accessible information included names, birth dates, addresses by city/state/ZIP, demographics, health measurements, eligibility and hospital admission, discharge and transfer information. [1]

  3. The database did not contain Social Security numbers or financial information, DHMP said. [1][2]

  4. DHMP’s notice says it had no evidence that the information was viewed or misused. It reported notifying affected people and resetting database-account passwords. [1][2]

Still unconfirmed

  • Whether anyone actually accessed or copied member information was not established.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 06:13 UTC.

Reported as potential exposure. Credential values and individual patient records were not accessed for this report.

  1. Statement Regarding Privacy Incident

    Denver Health Medical Plan · Primary source · 1 Oct 2026

  2. Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

    SecurityWeek · Reporting · 27 Oct 2026

    Separately owned reporting of the plan’s notice; not an independent forensic audit.

Report a factual error