SquareML access key leak exposes data of 238,000 Denver Health Medical Plan members
Severity: medium · Patch status: no-fix-needed · Since 2026-10-27
Denver Health Medical Plan is notifying 238,083 members after a SquareML access key was inadvertently published on a publicly accessible website on June 27, 2025. SquareML, a no-code healthcare analytics vendor, notified DHMP on August 14, 2026, and the key was revoked on August 18, 2026. During the exposure window the key could have been used to access a database containing names, dates of birth, ZIP codes, demographics, health metrics, plan eligibility, hospital admission, provider names, and discharge/transfer data. The compromised account was read-only, so data could not be downloaded, exported, deleted, or altered. No Social Security numbers or financial information were stored, and DHMP says there is no evidence data was viewed or misused. Passwords for all accounts with database access were reset, and additional remediation is underway.
What to do
- If you are a DHMP member, watch for breach notifications and consider credit/identity monitoring despite no SSN exposure
- Review vendor agreements and require prompt disclosure of credential leaks from third-party processors
- Audit and rotate any long-lived access keys or service credentials, especially those exposed in public repos or sites
- Restrict third-party database accounts to least privilege and read-only where possible
- Monitor database access logs for anomalous reads during the exposure window
Sources
All live incidents on Threat Watch
