Denver Health Medical Plan, a non-profit health plan affiliated with the Denver Health and Hospital Authority, has notified 238,083 current and former members that a vendor-related incident exposed protected health information. The vendor, SquareML, which supplies an AI and machine-learning analytics platform, added an access key to a public website on 27 June 2025; the key remained there for more than a year and was not deactivated until 18 August 2026, four days after the health plan was notified. Exposure covered full names, city/state/ZIP, demographics, dates of birth, health plan eligibility, provider names, admission, discharge and transfer information, and health metrics including BMI, HbA1c and eGFR; financial data and Social Security numbers were not included. Denver Health says the key was read-only and it has found no evidence of misuse. Separately, Johns Hopkins Bayview Medical Center and BASS Medical Group announced breaches. The same day, Kroll's Data Breach Outlook 2026 reported that 69% of individuals affected by a breach in the past year were caught in a third-party or vendor incident, with 79% of those reached via a technology-sector vendor.

• Source article