Breach · · 3 min read
Denver Health Medical Plan: vendor access key sat on a public website for over a year
A key that could read a database of 238,083 Denver Health Medical Plan members was public for more than a year. The plan says it has no evidence it was used.
Denver Health Medical Plan, a non-profit health plan in Colorado that runs Medicaid benefits for members in Denver and nearby counties, is writing to 238,083 current and former members. A vendor accidentally put a database access key on a public website, where it stayed for more than a year. If you’re a member or got a letter, here’s what happened.
What happened
The vendor is SquareML, which provides a health analytics platform. SquareML told the plan on August 14, 2026 that an access key had been published on a public website on June 27, 2025, SecurityWeek reported. The key was revoked on August 18, 2026. During that window, anyone who found it could have used it to read a database SquareML kept about the plan’s members.
According to the plan’s notice, as reported by The HIPAA Journal, the information that may have been seen includes:
- names, dates of birth, and city, state and ZIP code
- demographic information and health plan eligibility
- provider names and hospital admission, discharge and transfer details
- health measurements such as BMI and blood test results
Social Security numbers and financial information weren’t in the database. The key was read-only, so it couldn’t be used to download, export, change or delete records. The plan says it has no evidence the information was viewed or misused, only that it could have been. Passwords for every account with access to the database have been reset, and letters have been mailed to affected members.
What this means for you
With no Social Security or bank details involved, the risk of someone opening credit in your name from this alone is low. Health details are still personal, though, and names with dates of birth are useful to scammers. The most likely follow-up is a call or letter pretending to be your health plan or Medicaid, asking you to “verify” details or pay to keep coverage.
What you can do
- Read the letter if you got one, and call the number printed in it with any questions.
- Be wary of unexpected calls about your coverage. If a caller asks for payment or personal details to keep your benefits, hang up and call the number on your member card.
- Check the benefit statements you receive for visits or services you don’t recognize, and report anything odd to your plan.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame never collects or stores the leaked records themselves.
Sources
- SecurityWeek, Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk, October 27, 2026
- The HIPAA Journal, Denver Health Medical Plan Discloses Vendor Breach Affecting 238K Members, October 26, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.