--- title: "Denver Health Medical Plan SquareML access-key exposure" description: "Denver Health Medical Plan disclosed a publicly exposed SquareML key that could have allowed access to data about 238,083 members." incident_type: "Data incident" status: "active" last_modified: "2026-10-27" canonical_url: "https://www.ally.security/incidents/denver-health-medical-plan-squareml-key-exposure-2025" markdown_url: "https://www.ally.security/incidents/denver-health-medical-plan-squareml-key-exposure-2025.md" stix_url: "https://www.ally.security/incidents/denver-health-medical-plan-squareml-key-exposure-2025/stix.json" --- # Denver Health Medical Plan SquareML access-key exposure An inadvertently published vendor-platform key remained active until August 2026; the health plan reported no evidence of viewing or misuse. Last modified Oct 27, 2026 · 1 source ## Summary - **Environment:** SquareML access key and health-plan member database - **Operational impact:** Potential access to information about 238,083 members; no actual viewing established - **Financial impact:** No financial loss established; financial data excluded from affected database ## What happened [Denver Health Medical Plan](https://www.denverhealthmedicalplan.org/) learned on August 14, 2026 that an active access key for its SquareML platform had been posted on a public website. Its [October 1 privacy statement](https://www.denverhealthmedicalplan.org/sites/default/files/resources/document/Denver%20Health_News%20Release_DHMP%20SquareML%20Security%20Incident_FINAL%2010.2.26.pdf) said the key had been inadvertently published on June 27, 2025. It was deactivated on August 18, 2026. [1](#source-1) ## Impact The key could have allowed access to a database with information about 238,083 members. This is a potentially exposed population, not a confirmed count of people whose records were viewed or stolen. The health plan reported no evidence of viewing or misuse. [1](#source-1) Potentially accessible information included names, birth dates, city, state and ZIP code, demographic details, health metrics, plan eligibility, provider information, and admission, discharge or transfer details. The database did not contain Social Security numbers or financial data. [1](#source-1) ## Timeline ### June 27, 2025 — Access key inadvertently published The health plan's investigation dated the public key exposure to June 2025. [1](#source-1) ### August 14, 2026 — Health plan informed DHMP learned that the active key was available publicly. [1](#source-1) ### August 18, 2026 — Key deactivated The exposed credential was disabled. [1](#source-1) ### October 1, 2026 — Privacy statement issued The notice described the potential exposure and member notifications. [1](#source-1) ### October 27, 2026 — Briefing updated This briefing was last reviewed and updated on October 27, 2026. ## Threat Group & Attack Vector An inadvertently published access key created a possible route to member information. The notice does not establish malicious use of that key or confirmed data theft. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - No specific MITRE ATT\&CK technique is currently mapped for this case. ## Response DHMP deactivated the key, reset account passwords, investigated the exposure and reviewed vendor safeguards. It described HIPAA reporting and notification letters to potentially affected members. The public statement does not establish whether anyone accessed the database during the exposure window. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Denver Health Medical Plan Issues Statement Regarding Privacy Incident official · Denver Health Medical Plan · Oct 1, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: Health plan issues privacy statement 2. **Occurred At · 100% confidence · current** Health plan issues privacy statement: 2026-10-01 3. **Occurred At · 100% confidence · current** Access key inadvertently made public: 2025-06-27 4. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: Access key inadvertently made public 5. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: Health plan informed of exposed key 6. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: DHMP learned on August 14, 2026 that an active SquareML access key had been posted on a public website. It found the key was inadvertently published on June 27, 2025 and deactivated it on August 18, 2026. 7. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: Exposed key deactivated 8. **Discovered At · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: 2026-08-14 9. **Resulted In · 100% confidence · current** Potential access to member database through publicly posted SquareML key: Potential information included names, birth dates, city/state/ZIP, demographic information, health metrics, plan eligibility, provider information and admission, discharge or transfer details. The database did not contain Social Security numbers or financial data. 10. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: Potential access to member database through publicly posted SquareML key 11. **Affected Organization · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: Denver Health Medical Plan 12. **Occurred At · 100% confidence · current** Health plan informed of exposed key: 2026-08-14 13. **Resulted In · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: DHMP deactivated the key, reset account passwords, investigated and reviewed vendor safeguards. It described HIPAA reporting and mailing notification letters to potentially affected members. 14. **Resulted In · 100% confidence · current** Potential access to member database through publicly posted SquareML key: The key could have allowed access to a database containing information about 238,083 members. DHMP reported no evidence that the information had been viewed or misused. 15. **Occurred At · 100% confidence · current** Exposed key deactivated: 2026-08-18 16. **Disclosed At · 100% confidence · current** Denver Health Medical Plan SquareML access-key exposure: 2026-10-01 17. **Affected Individual Count · 100% confidence · current** Potential access to member database through publicly posted SquareML key: 238,083