2026 Denver Health Medical Plan — vendor SquareML access key exposed on a public website; health data of 238,083 members
Data compromised
Per reporting on the notice: names, location details, dates of birth, plan eligibility information, provider names, admission and discharge records, and health metrics (BMI, HbA1c, eGFR) for current and former members. Financial information and Social Security numbers were reportedly not exposed.
Technical writeup
First public report located: HIPAA Journal, October 26, 2026. The plan says notification letters have been mailed; the letter date is not stated in the report. The records reachable with the key included protected health information. One investigation site describes the account as read-only; that detail is secondary and unconfirmed. The vendor is an AI and machine-learning analytics platform. recordsAffected 238083 is the plan’s count.
Root cause
An access key used by vendor SquareML was posted to a public website by the vendor on June 27, 2025, and stayed there for more than a year. The plan learned of it on August 14, 2026, and the key was deactivated on August 18, 2026. The plan says it has not identified any evidence that the key was misused.