Here is the call this record makes possible. A woman in Aurora answers a number she does not know. The caller says he is with care management at her health plan. He has her full name and her date of birth. Her A1C came back high in the spring, and he mentions it. Then he names her doctor and the week she came home from the hospital. Then he asks her to confirm her member ID so he can release a benefit. Nothing in that opening had to be guessed, because all of it sits in the file at the center of the Denver Health data breach.
Confirmation: confirmed by the company. Denver Health Medical Plan published its own notice on October 1, 2026. DHMP says it has no evidence that member information was viewed or misused, only that it may have been.
What happened in the Denver Health data breach
Denver Health Medical Plan is a nonprofit health plan inside the Denver Health and Hospital Authority. It administers Health First Colorado benefits through Denver Health Medicaid Choice. Like most plans its size, it sends member data to analytics vendors. One of those vendors is SquareML, which runs a no-code platform for healthcare analytics.
On June 27, 2025, SquareML published a working access key on a publicly accessible website. The key opened a SquareML database holding records on 238,083 DHMP members. It stayed there. DHMP learned of it on August 14, 2026. The key went dead on August 18, 2026. That is 417 days of a live credential sitting in public.
The account behind the key was read-only. DHMP says nobody could use it to download, export, delete or change anything, which genuinely narrows the damage. But read-only is still read. The plan has mailed letters to affected members and opened a hotline on 888-766-0023. It is reporting the incident under HIPAA.
What was exposed, and what was not
The Denver Health data breach notice lists the contents of the database. Each line is worth reading slowly, because each one does different work for somebody who wants to sound like your care team.
- Full name, date of birth, city, state, ZIP code and demographic information. This is
- Health metrics including BMI, HbA1c and eGFR. HbA1c is a diabetes control marker.
- **Health plan eligibility data, provider name, and hospital admission, discharge and
the part that makes a stranger sound like a records clerk.
eGFR measures kidney function. Together they describe a chronic condition, how well it is managed, and roughly how sick someone is.
transfer information.** So: who covers you, who treats you, and the dates you were in a bed.
Social Security numbers and financial information were not in this database. Neither were email addresses, and that absence matters for what comes next. Nobody can mail you from this file, because this file does not contain an address to mail.
Why a discharge date is worth more here than a password
A leaked password is a key. It is dangerous, and you can replace it in about ninety seconds. A leaked HbA1c result is not a key, and nobody can replace it at all.
What it buys an attacker is credibility. Fraud that opens with your diagnosis, your provider’s name and the week you were discharged does not read as fraud. It reads as follow-up. That is why health records sell for more than card numbers, and why this set is a privacy problem rather than a security one. OptMsg treats that distinction as structural, and it shapes our Private approach.
There is a second effect, and it is the one that lands in an inbox. Right now 238,083 people are receiving a real letter about a real incident from a real health plan. Everyone in that group is primed to respond to a message about it. In short, a breach notice is the easiest thing in the world to fake once a genuine one exists.
What to do now about the Denver Health data breach
Most of this has nothing to do with us, and that is fine.
Treat unexpected contact about your care as unverified. If someone calls about a benefit, a bill or a records update, hang up and call the number on your member card. The caller knowing your details is no longer evidence of anything.
Call the hotline yourself rather than waiting. 888-766-0023 is DHMP’s line for this incident. Use it to confirm whether you are in the 238,083 instead of trusting a letter that arrived.
Read your Explanation of Benefits statements for care you did not get. Medical identity theft shows up there first, often months later.
Use a password manager and the strongest sign-in your health portal offers. No password leaked here, so this is general hygiene rather than cleanup. It is still the highest-value twenty minutes you can spend.
Expect the follow-up phish dressed as Denver Health. It will reference the real incident, because the real incident is public. Open your portal by typing the address rather than by following a link.
How OptMsg changes this exposure
Start with what it does not do, because the honest version is the useful one. OptMsg could not have prevented any of this. A vendor published the key into a public place, and no inbox choice of yours touches that. This file holds no email address either, so nobody can use it to write to you. At its source, the Denver Health data breach is not an email problem at all.
What an inbox changes is the wave that follows a public notice. Mail from a sender you have not approved goes to Trash rather than your Inbox, and Trash auto-deletes after 30 days. So the message that arrives next week wearing a hospital logo and a records-update subject line lands there, away from the mail you actually read. Community Recommendations then flag a message in Trash that many OptMsg users have opted in to, so you see a letter you do want before the 30 days run out.
What the sign-in design covers, and what it leaves alone
The sign-in half is narrower, and it is worth saying at its real size. Your OptMsg account has no password, and passkeys are the primary way in. So if you reuse a password across a patient portal and your email, a password leaked from somewhere else has no matching password on your inbox to try. Credential stuffing needs a password to try.
What this does not cover, plainly: a phone call, a paper letter, a compromised device, a live phishing page you type your details into, or a message from a sender you already approved. Three of those four are the main risks from this particular file. The inbox argument is about the follow-up mail, and it is worth exactly that much.
If the follow-up wave is what worries you, you can create an OptMsg account and forward your existing mail to it to see how it reads.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Was my information in the Denver Health data breach? Call 888-766-0023, the hotline DHMP opened for this incident. The plan has also mailed letters to affected members. If you are a Denver Health Medicaid Choice member, assume you may be in the 238,083 until the hotline tells you otherwise.
Did anyone actually read my records? DHMP says it has no evidence that member information was viewed or misused, only that it may have been. The account was read-only, so nobody could export or alter anything. Nobody knows who used a key that sat in public for 417 days, and that is the honest answer.
Were my Social Security number and email address exposed? No. DHMP’s notice states that Social Security numbers and financial information were not in this database, and email addresses are not in the list of fields it published either.
Why did it take 26 days to hear about this? DHMP published its notice on October 1, 2026, and mailed letters to affected members. The story reached the wider security press on October 27. Local notices often travel slowly, which is one reason a scam email can arrive before you have read the real one.
What should I watch for over the next few months? Phone calls and letters that open with details only your care team should know. Also read every Explanation of Benefits statement for services you did not receive, because medical identity theft surfaces there before it surfaces anywhere else.
Sources
- Denver Health Medical Plan, “Denver Health Medical Plan Issues Statement Regarding Privacy Incident,” October 1, 2026 — https://www.denverhealthmedicalplan.org/sites/default/files/resources/document/Denver%20Health_News%20Release_DHMP%20SquareML%20Security%20Incident_FINAL%2010.2.26.pdf
- SecurityWeek, “Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk,” October 27, 2026 — https://www.securityweek.com/vendor-key-leak-puts-data-of-238000-denver-health-plan-members-at-risk/
- US Department of Health and Human Services, HIPAA for Individuals — https://www.hhs.gov/hipaa/for-individuals/index.html
Previous in Breach Breakdown: The DreamHost Security Incident: Reset Your Email, Then Watch For The Fake Email.
Next in Breach Breakdown: The Homeland Security Data Breach: 41,000 Work Emails Are Now Public
