ClaimDepot’s October 26, 2026 page about SquareML reports that Denver Health Medical Plan was notified on August 14, 2026, that an active access key associated with SquareML had been found on a publicly accessible website. The page says the credentials were published on June 27, 2025, and remained accessible until the key was deactivated on August 18, 2026. Shamis & Gentile P.A. is investigating the incident. The page describes the compromised account as read-only.
The page says the database contained information about 238,083 Denver Health Medical Plan members. Potentially exposed information included names, dates of birth, location and demographic details, health metrics, plan eligibility, provider names, and hospital admission, discharge, and transfer information. It says Social Security numbers and financial data were not included. The page does not state when SquareML discovered the issue, when regulators were notified, or when members were notified. Further details may emerge, and notification timing is not stated.