Summary
- Environment: SquareML access key and health-plan member database
- Operational impact: Potential access to information about 238,083 members; no actual viewing established
- Financial impact: No financial loss established; financial data excluded from affected database
- Record status: Developing record. Reviewed October 27, 2026; updated as evidence emerges.
What happened
Denver Health Medical Plan learned on August 14, 2026 that an active access key for its SquareML platform had been posted on a public website. Its October 1 privacy statement said the key had been inadvertently published on June 27, 2025. It was deactivated on August 18, 2026. [1]
Impact
The key could have allowed access to a database with information about 238,083 members. This is a potentially exposed population, not a confirmed count of people whose records were viewed or stolen. The health plan reported no evidence of viewing or misuse. [1]
Potentially accessible information included names, birth dates, city, state and ZIP code, demographic details, health metrics, plan eligibility, provider information, and admission, discharge or transfer details. The database did not contain Social Security numbers or financial data. [1]
Timeline
Access key inadvertently published
The health plan’s investigation dated the public key exposure to June 2025.
[1]Health plan informed
DHMP learned that the active key was available publicly.
[1]Key deactivated
The exposed credential was disabled.
[1]Privacy statement issued
The notice described the potential exposure and member notifications.
[1]Briefing updated
This briefing was last reviewed and updated on October 27, 2026.
Threat Group & Attack Vector
An inadvertently published access key created a possible route to member information. The notice does not establish malicious use of that key or confirmed data theft. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
DHMP deactivated the key, reset account passwords, investigated the exposure and reviewed vendor safeguards. It described HIPAA reporting and notification letters to potentially affected members. The public statement does not establish whether anyone accessed the database during the exposure window. [1]