SquareML Data Breach Impacts 238k Individuals - Claim Depot

Denver Health Medical Plan (DHMP), a nonprofit health insurance company, has revealed that a data breach at its vendor SquareML may have compromised the personal and health information of 238,083 members. The healthcare analytics vendor supports DHMP operations and maintained the database containing the sensitive information.

Breach Details

The incident occurred when SquareML inadvertently published an active access key on a publicly accessible website on June 27, 2025. The digital credential remained exposed for nearly 14 months before being discovered. DHMP learned of the issue on August 14, 2026, and publicly announced the incident on October 1, 2026.

The compromised account was read-only, meaning the exposed access key could not have been used to download, export, delete or change any information. The database contained full names, dates of birth, addresses, and demographic information, as well as protected health metrics like BMI, HbA1c, and eGFR.

Response Measures

DHMP has mailed letters to affected individuals with details about the incident and steps they can take to protect their information. A dedicated hotline has been established at 888-766-0023 for individuals with questions related to the breach. Social Security numbers and financial information were not included in the compromised database.