Denver Health Medical Plan, a non-profit managed care organization, has reported a data breach potentially compromising the personal and health information of 238,000 members. This incident involves SquareML, a third-party vendor that offers a no-code platform for healthcare analytics. The breach came to light when SquareML informed Denver Health Medical Plan on August 14, 2026, that an access key had been inadvertently leaked online. This key, which was publicly accessible from June 27, 2025, to August 18, 2026, might have been used to access a database containing sensitive information of Denver Health's members. Although the compromised account was read-only, limiting the potential misuse of the data, the information at risk includes names, dates of birth, ZIP codes, demographic details, health metrics, and hospital-related data. Importantly, Social Security numbers and financial information were not stored in the affected database. There is currently no evidence that the data has been accessed or misused, but the potential risk remains. In response, Denver Health Medical Plan and SquareML have reset passwords for all accounts with database access and are undertaking additional security measures to prevent future incidents.
Data Breach Threatens Personal Information of 238,000 Denver Health Plan Members
Leaked SquareML access key may have exposed a database with personal and health information for 238,000 members.
Executive Summary
A data breach at Denver Health Medical Plan may have exposed the personal and health information of 238,000 members due to a leaked access key from vendor SquareML. The breach is under investigation, though there is no evidence of data misuse at this time.
Actionable Insights
- Conduct a thorough audit of third-party vendor access to sensitive data.
- Implement regular checks to ensure that access keys and credentials are not exposed online.
- Enhance monitoring systems to detect and respond to unauthorized access in real-time.
Full Story
Original source
securityweek.com
