Denver Health Says Vendor Key Exposed Data of 238,083 Members

Denver Health Medical Plan (DHMP) has disclosed a data breach potentially exposing the personal and health information of 238,083 members after a security lapse with a third‑party vendor, SquareML. SquareML, which provides a no‑code platform for healthcare analytics, notified DHMP on 14 August 2026 that an access key had been inadvertently exposed on a publicly accessible website. The key had been published online on 27 June 2025 and was revoked on 18 August 2026. During the window when the key was active, it could have been used to access a SquareML database containing member data.

DHMP states the compromised account was read‑only, meaning no information could be downloaded, exported, deleted or altered. The potentially exposed data include names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission details, provider names, and discharge and transfer information. DHMP notes that the database did not store Social Security numbers or financial information.

As a precaution, passwords for all accounts with access to the database have been reset, and DHMP and SquareML are pursuing further remedial actions. DHMP also emphasises that, to date, there is no evidence that member information was viewed or misused, only that it may have been accessed during the exposure window. The health plan affiliate has issued an incident notice and is coordinating with SquareML on the response.