Leaked SquareML key may have exposed 238,083 Denver Health Plan members
Original title: Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
A read-only access key sat on a public site from June 27, 2025, until revocation on August 18, 2026, with no proof of misuse.
Denver Health Medical Plan is notifying 238,083 members that personal and health data may have been exposed after vendor SquareML leaked a database access key on a public website. SquareML told DHMP on August 14, 2026. The key was published June 27, 2025, and revoked August 18, 2026. The account was read-only, so it could not download, export, delete, or change records. DHMP says it has no evidence the data was viewed or misused, and passwords for database accounts were reset.
Unconfirmed: DHMP says it has no evidence member information was viewed or misused, only that it may have been.
- Exposed fields include names, dates of birth, ZIP codes, health metrics, eligibility, and admission data.
- The database did not store Social Security numbers or financial information.
- DHMP administers Health First Colorado Medicaid benefits in Denver and three nearby counties.
- Passwords for all accounts with database access were reset after the notice.
Impact: Possible read-only access to member personal and health data
- Vendors
- SquareML
- Victims
- Denver Health Medical Plan
- Organizations
- Denver Health and Hospital Authority
- Countries
- United States
From the original article
1 min read at securityweek.com
A leaked SquareML access key could have been used to access a database containing personal and health information. The post Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.