Denver Health Medical Plan disclosed that an access key tied to its third-party analytics vendor, SquareML, was left exposed on a public website. The exposure occurred between June 27, 2025, and August 18, 2026. The organization learned of the exposed credential on August 14, 2026, and deactivated the key on August 18, 2026. Public notifications and individual notification letters began on October 1, 2026.
The incident potentially compromised the records of 238,083 members. Compromised information included full names, dates of birth, city, state, ZIP codes, demographic information, health metrics such as BMI, HbA1c, and eGFR, health plan eligibility details, provider names, and hospital admission, discharge, and transfer records. Social Security numbers and financial details were not included in the exposed database.
The organization reported that the access key was read-only and credentials were reset following the discovery. As organizations review vendor environments and access logs, additional findings or adjusted impact figures can emerge.