Software security | Vulnerabilities

Leaked Vendor Key Exposed Denver Health Plan Data for 14 Months

A Denver health plan says anyone with its vendor’s leaked key could have viewed nearly a quarter-million members’ health records. No misuse found.

By Content Team

Oct 28, 2026

ON THIS PAGE

Denver Health Medical Plan (DHMP) is notifying 238 083 current and former members that their personal and health data may have been exposed after an access key belonging to its analytics vendor, SquareML, was accidentally leaked on a public website.

The key went online on June 27, 2025, and stayed live until it was revoked on August 18, 2026 — a 14-month exposure window. SquareML told DHMP about the leak on August 14.

The key gave read-only access to a SquareML database holding names, birth dates, ZIP codes, plan eligibility, hospital admission and discharge data, and health metrics such as BMI, HbA1c, and eGFR values. It couldn’t be used to download, export, or change records, and no Social Security numbers or financial data were stored there.

DHMP says it has no evidence the information was viewed or misused, only that it may have been, and has reset passwords on all accounts with database access.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?