BreachPublished 27 Oct 2026

Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

Source SecurityWeek

Description

A leaked SquareML access key potentially exposed personal and health information of 238,000 Denver Health Medical Plan members. The key was publicly accessible from June 27, 2025, until it was revoked on August 18, 2026. The compromised account was read-only, limiting the ability to alter or export data. The exposed data includes names, dates of birth, demographic details, health metrics, and hospital admission information, but excludes Social Security numbers and financial data. There is no evidence that the data was accessed or misused, only that it may have been.

Impact

Potential unauthorized access to personal and health information of 238,000+ individuals, including sensitive health metrics and hospital admission data. The read-only nature of the compromised credentials limited the risk of data alteration or deletion. No Social Security numbers or financial information were exposed. No confirmed evidence of data viewing or misuse has been reported.

Defensive guidance

The leaked access key was revoked on August 18, 2026. DHMP reset all passwords for accounts with access to the affected database. DHMP and SquareML are pursuing additional remedial actions. Organizations should verify that access keys and credentials are not publicly exposed and implement strict access controls and monitoring for third-party services.

Summary

Denver Health Medical Plan (DHMP) experienced a data breach due to a leaked access key from third-party vendor SquareML, which provides healthcare analytics services. The access key was inadvertently published on a public website for over a year and could have been used to access a database containing personal and health information of 238,083 members. The compromised credentials were read-only, preventing data modification or export. The exposed data set includes personal identifiers and health-related information but excludes Social Security numbers and financial details. DHMP reset all passwords for accounts with database access and is working with SquareML on further remediation. There is currently no evidence of data misuse.

References

securityweek.com/vendor-key-leak-puts-data-of-238000-denver-health-plan-members-at-risk/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Oct 2026, 13:41 UTC

Technical details

References

Community reviews