Vendor Key Leak Exposes Denver Health Plan Data for 238,000 Members
A leaked access key from third-party vendor SquareML potentially exposed the personal and health data of 238,000 Denver Health Plan members.
Denver Health Medical Plan (DHMP) has initiated notifications to approximately 238,000 individuals whose personal and health information may have been compromised due to a data breach involving a third-party vendor. The incident underscores the critical importance of securing access credentials in the healthcare sector.
DHMP, a non-profit managed care organization operating within the Denver Health and Hospital Authority system, administers Health First Colorado (Medicaid) benefits for members in Denver and surrounding counties. The breach occurred through SquareML, a vendor that provides a no-code analytics platform specifically for the healthcare industry.
According to DHMP's official incident notice, SquareML alerted the health plan administrator on August 14, 2026, after discovering that an access key had been inadvertently published on a publicly accessible website. This key, initially posted online on June 27, 2025, remained exposed until its revocation on August 18, 2026. During this period, it could have been exploited to gain unauthorized access to a database managed by SquareML.
The compromised access key was reportedly read-only, meaning it could not be used to download, export, delete, or modify any information within the database. However, the potential exposure of sensitive data remains a significant concern for affected members.
The types of information potentially accessed include names, dates of birth, ZIP codes, city and state of residence, demographic details, health metrics, health plan eligibility data, and records pertaining to hospital admissions, provider names, and discharge/transfer information. Notably, the database did not contain Social Security numbers or financial account details.
DHMP has stated that there is currently no evidence to suggest that any member information was actually viewed or misused. The notification is based on the possibility that the data *may* have been accessed due to the exposed credentials. Nevertheless, the health plan is taking proactive measures to address the situation.
In response to the incident, DHMP and SquareML have reset passwords for all accounts that had access to the affected database. Both organizations are also reportedly pursuing additional remedial actions to enhance security and prevent future occurrences. This incident serves as a stark reminder of the vulnerabilities introduced through third-party vendor relationships and the necessity of robust credential management practices.
The breach highlights a persistent challenge in the healthcare industry: balancing the need for data accessibility and analytics with the imperative to protect highly sensitive patient information. As organizations increasingly rely on third-party vendors and cloud-based solutions, the security posture of these partners becomes as critical as their own.