An active access key tied to SquareML, a healthcare analytics vendor used by Denver Health Medical Plan (DHMP), sat on a publicly accessible website for about 14 months before anyone shut it off. DHMP says the key could have opened a vendor database holding information on all 238,083 of its members, and it is now notifying those people that their personal and health data may have been exposed.
DHMP, a nonprofit health plan within the Denver Health and Hospital Authority system, confirmed the incident in a public statement dated Oct. 1, 2026. An alert banner on denverhealthmedicalplan.org also links to the notice.
A vendor key left public for 417 days
According to DHMP, SquareML inadvertently published the credentials on June 27, 2025. DHMP says it was informed on Aug. 14, 2026, that the active key had been discovered on a public website. The key was deactivated on Aug. 18, 2026, four days later. That leaves a window of 417 days in which anyone who found the key could have used it.
DHMP has not said which website hosted the key, what cloud service or database product it unlocked, or who discovered it. The plan’s website banner says SquareML “became aware” of the incident on Aug. 14, while the press release says DHMP “was informed” that day.
SquareML, which markets a no-code AI and machine learning analytics platform for health plans and hospitals at squareml.ai, had not issued any public statement at time of publication.
Health metrics and hospital visit data in the database
DHMP says the SquareML database contained the following member information:
- Full name, date of birth, city, state, ZIP code and demographic information
- Health metrics, including BMI, HbA1c (a long-term blood sugar measure) and eGFR (a kidney function measure)
- Health plan eligibility data and provider names
- Hospital admission, discharge and transfer information
DHMP says Social Security numbers and financial information were not stored in the database. The plan has not said whether every field applies to every member.
What “read-only” does and does not rule out
DHMP stresses that the exposed account was read-only. It says the key “could not be used to download, export, delete or change any information.” The plan also says it has “no evidence that member information was viewed or misused, only that it may have been.”
That wording leaves an important gap. A read-only credential still lets its holder query and view records, and data that can be viewed can usually be copied. DHMP has not said whether the database kept access logs covering the full 417-day window, or whether those logs were reviewed. Without that detail, the plan cannot rule out access, and it has not claimed to.
Exposed cloud keys and API tokens are a recurring problem in vendor environments. Security researchers regularly find live credentials in public code repositories, web pages and configuration files, and automated scanners can pick them up soon after they appear.
How DHMP and SquareML responded
After learning of the exposure, DHMP says it launched an internal investigation and worked with SquareML to secure the data. The public key was voided, passwords were reset for all accounts with access to the database, and DHMP says it is evaluating additional remedial actions with the vendor.
The incident was reported to the HHS Office for Civil Rights breach portal on Oct. 1, 2026, according to reports, as a hacking/IT incident involving a network server and a business associate. DHMP says it is following required HIPAA reporting procedures.
The breach adds to a run of healthcare incidents tied to third parties, including the Veradigm vendor compromise and unauthorized access to the Quest Diagnostics Quanum lab ordering portal.
What DHMP members should do now
DHMP says it has mailed letters to affected members explaining the incident and steps they can take. The public notice does not mention free credit monitoring or identity protection services, and no enrollment deadline has been published.
- Read and keep the DHMP letter, which should explain how the incident applies to you.
- Call the dedicated hotline at 888-766-0023 with questions or to request substitute notice if no letter arrived.
- Review explanation of benefits statements for visits or services you did not receive.
- Treat calls, texts and emails that reference your health plan, provider or recent hospital stay with caution, and call back using the number on your member ID card.
- Ask DHMP directly whether monitoring or identity protection is being offered.
Because the exposed data includes clinical measures and hospital visit records rather than financial details, the main risk is targeted phishing and medical identity fraud rather than direct financial theft.
