Denver Health Notifies 238,000 Members of Vendor SquareML Data Leak
Denver Health Medical Plan notified 238,083 current and former members after vendor SquareML inadvertently published an access key on a public website; the key stayed online from June 27, 2025 until August 18, 2026. The key could have been used to access a database with members' personal and health data; DHMP says it has no evidence of misuse and reset passwords on all accounts with database access. Organizations using analytics vendors should check for credentials exposed on public sites.
What happened
Denver Health Medical Plan notified 238,083 current and former members about an incident at vendor SquareML, an AI analytics platform. A vendor access key was published on a public website from June 27, 2025 to August 18, 2026 and could have been used to access a database holding members' health information.
Why it matters
Exposed data includes full names, dates of birth, city/state/ZIP, demographic details, plan eligibility, provider names, admission/discharge/transfer data, and health metrics such as BMI, HbA1c, and eGFR. Social Security numbers and financial information were not in the database. The plan administers Health First Colorado (Medicaid) benefits in Denver and three surrounding counties.
What to do
Require vendors to scan for access keys exposed on public sites and repositories, with leaked-credential alerting. Review third-party account permissions on databases holding sensitive data.
For the technical team
- Affected
- SquareML Denver Health Medical Plan (plano de saúde de Denver, EUA); banco de dados do fornecedor SquareML, acessível por chave de acesso vazada · Database maintained by SquareML holding data on 238,083 current and former Denver Health Medical Plan members.
- Exploitation
- DHMP reports no evidence that the key was misused or that member information was viewed; only that access may have occurred during the exposure window.
- Fix
- Key deactivated on August 18, 2026; passwords reset for all accounts with database access; DHMP and SquareML pursuing additional remedial actions.
- Vector
- SquareML vendor access key inadvertently published on a public website on June 27, 2025; it remained active until it was revoked on August 18, 2026. Per DHMP, the compromised account was read-only: the key could not download, export, delete, or change information.
- More details
- SquareML notified DHMP on August 14, 2026. Exposed fields: full names, city/state/ZIP, demographic data, dates of birth, plan eligibility, provider names, admission/discharge/transfer information, and health metrics (BMI, HbA1c, eGFR). No Social Security numbers or financial information stored.
Timeline
SecurityWeek details that a leaked SquareML access key could have been used to access the database with members' personal and health data.
Incident opened.
Sources 2 sources
- Denver Health Medical Plan Discloses Vendor Breach Affecting 238K Members HIPAA Journal
- Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk SecurityWeek
