Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

Denver Health Medical Plan (DHMP) is notifying 238,000 people that their personal and health information may have been compromised in a data breach. Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health and Hospital Authority system. Through its Denver Health Medicaid Choice plan, it administers Health First Colorado (Medicaid) benefits for members in Denver and three surrounding counties. The data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics. According to DHMP’s incident notice (PDF), SquareML notified the health plan administrator on August 14, 2026, that an access key was inadvertently leaked on a publicly accessible website. “These credentials may have been used to access a database maintained by SquareML containing information DHMP’s 238,083 members,” DHMP says. The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database. “The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Based in Denver, Colorado, DHMP is a non-profit managed care organization within the Denver Health and Hospital Authority system. Through its Denver Health Medicaid Choice plan, it administers Health First Colorado (Medicaid) benefits for members in Denver and three surrounding counties. The data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics. According to DHMP’s incident notice (PDF), SquareML notified the health plan administrator on August 14, 2026, that an access key was inadvertently leaked on a publicly accessible website. “These credentials may have been used to access a database maintained by SquareML containing information DHMP’s 238,083 members,” DHMP says. The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database. “The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

The data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics. According to DHMP’s incident notice (PDF), SquareML notified the health plan administrator on August 14, 2026, that an access key was inadvertently leaked on a publicly accessible website. “These credentials may have been used to access a database maintained by SquareML containing information DHMP’s 238,083 members,” DHMP says. The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database. “The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

According to DHMP’s incident notice (PDF), SquareML notified the health plan administrator on August 14, 2026, that an access key was inadvertently leaked on a publicly accessible website. “These credentials may have been used to access a database maintained by SquareML containing information DHMP’s 238,083 members,” DHMP says. The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database. “The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

“These credentials may have been used to access a database maintained by SquareML containing information DHMP’s 238,083 members,” DHMP says. The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database. “The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

The access key was published online on June 27, 2025, and was revoked on August 18, 2026. During this window, it could have been used to access the personal and health information stored in the database. “The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

“The compromised account was read-only, meaning the access key could not be used to download, export, delete, or change any information,” DHMP notes. The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

The potentially compromised information includes names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data. According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

According to DHMP, the database did not store Social Security numbers or financial information. “At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

“At this time, DHMP has no evidence that member information was viewed or misused, only that it may have been,” the health plan affiliate notes. In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

In response to the incident, the passwords for all accounts that had access to the database were reset, and DHMP and SquareML are pursuing additional remedial actions. Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Related: Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’ Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Related: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Related: iRhythm Data Breach Impacts at Least 360,000 People Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million

Ionut Arghire is an international correspondent for SecurityWeek.

More from Ionut Arghire

Genesys Hack Exposes Customer Data From Internal Systems

953 Online Stores Infected in Long-Lasting Malware Campaign

Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

Mythos 5 Ignored Real-World Harm in July Attack

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Attackers Exploit Third Arista VCO Zero-Day in Four Months

11 Million Impacted by Capcom Data Breach

LiteLLM Compromised in Fresh Supply Chain Attack

HPE Patches Dozens of Critical Flaws in Networking Products

Unexplained DreamHost Incident Prompts Email, FTP Password Resets

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI

This is Fine: What NetScaler Zero-Days Tell Us the New Normal

Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover

Maritime Coalition Launches Free Vulnerability Database for Ship and Port Systems

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

Flipboard Whatsapp Whatsapp Email