Leaked Vendor Key May Have Exposed Data of 238,000 Denver Health Plan Members
Summary
DHMP says a publicly exposed SquareML access key may have enabled access to information about 238,083 members. The key was revoked, and DHMP says it has no evidence the data was viewed or misused.
Key points
- DHMP says SquareML notified it on August 14, 2026, that an access key had been inadvertently exposed on a publicly accessible website.
- The key was published on June 27, 2025, and revoked on August 18, 2026; DHMP says it could have enabled access to a SquareML database containing information about 238,083 members.
- The potentially exposed information included names, birth dates, demographic and health metrics, eligibility data, and hospital and provider details.
- DHMP says the database did not contain Social Security numbers or financial information.
- The account was read-only, and DHMP says it has no evidence that member information was viewed or misused.
- DHMP and SquareML reset passwords for accounts with database access and are pursuing additional remedial actions.
Article Details
- Victim Organization
- Denver Health Medical Plan (DHMP)
- Incident Type
- A read-only access key was exposed on a publicly accessible website, creating the possibility of unauthorized access to a database containing member information.
- Incident Date
- 2025-06-27
- Data Types Exposed
- Names
- Dates of birth
- ZIP codes
- City and state
- Demographic information
- Health metrics
- Health plan eligibility data
- Hospital admission data
- Provider names
- Discharge and transfer data
- Affected Records
- 238,083 members potentially affected
- Operational Impact
- The exposed key was read-only and could not be used to download, export, delete, or change information. DHMP reported no evidence that member information was viewed or misused. Passwords for accounts with database access were reset, and DHMP and SquareML are pursuing additional remedial actions.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed