Denver Health Medical Plan notifies 238,083 members after vendor SquareML leaks access key

TLDR

• Denver Health Medical Plan is notifying 238,083 members after vendor SquareML leaked a read-only access key on a public website.¹²
• The key was exposed from 27 June 2025 until it was deactivated on 18 August 2026.¹
• DHMP has no evidence member data was viewed or misused; Social Security numbers and financial data were not included.¹²

Denver Health Medical Plan (DHMP), a non-profit health plan within the Denver Health and Hospital Authority system, says a data security incident at SquareML, a healthcare analytics vendor that supports its operations, may have exposed information on 238,083 members.¹² DHMP says it was informed on 14 August 2026 that an active access key associated with SquareML had been found on a publicly accessible website, and that the credentials may have been used to access a SquareML database containing member information.¹ SecurityWeek reports that SquareML was the party that notified the health plan.²

DHMP says SquareML inadvertently published the credentials on 27 June 2025 and that the key was deactivated on 18 August 2026.¹ The HIPAA Journal reports the key remained on the public website for more than a year.³ DHMP says the account was read-only, so the key could not be used to download, export, delete or change information, and that it has no evidence the information was viewed or misused, only that it may have been.¹²

The database held full names, dates of birth, city, state, ZIP code and demographic information; health metrics including BMI, HbA1c and eGFR; and health plan eligibility data, provider names and hospital admission, discharge and transfer information, DHMP says.¹ DHMP says Social Security numbers and financial information were not in the database.¹²³

DHMP says it launched an internal investigation, voided the key, reset passwords for all accounts with access to the database and is evaluating further remedial actions with the vendor.¹ It says it has mailed letters to affected individuals, set up a hotline on 888-766-0023 and is following the reporting procedures required under HIPAA.¹ DHMP's news release is dated 1 October 2026, while The HIPAA Journal published its report on 26 October and SecurityWeek on 27 October.¹²³

Why it matters: the exposure came from a vendor publishing a credential rather than from an attack on DHMP, and DHMP says it has no evidence that member information was viewed or misused, only that it may have been.¹²