Denver Health Medical Plan is alerting 238,083 members that personal and health details may have been exposed through a vendor’s leaked access key, not through any flaw on the health plan’s own network.
The organization is a nonprofit managed care arm of the Denver Health and Hospital Authority, handling Health First Colorado Medicaid coverage in Denver and three surrounding counties. The vendor is SquareML, a no-code analytics provider.
Word came to the plan from SquareML on August 14, 2026. A key issued to the vendor had been left, by accident, on a site anyone could read. That key was issued in late June 2025 and finally killed in mid August 2026, fourteen months later.
Read-only does not mean harmless
The exposed account carried read-only rights, so the key could not download, export, delete or modify records in bulk. That narrows the risk without removing it, since a read path still permits viewing and querying.
Data in scope includes names, dates of birth, postal codes, city and state, and demographics. Health plan enrollment details sat in the same database, which held no Social Security numbers or financial records.
The lesson for third-party programs
This is the ordinary shape of a healthcare breach now. No malware, no encryption, no extortion. A service credential issued for convenience escaped the vendor’s control and nobody noticed for a year.
Review which analytics and reporting vendors hold standing keys to member data, whether those keys are read-only by design, and how long they stay valid. Secrets that never expire are the recurring failure. Require rotation, and confirm the vendor will report a leak directly.
For affected members, the practical exposure is identity and insurance context, enough for convincing benefit-themed phishing. Treat unsolicited calls about coverage as suspect and verify through a number you look up yourself.
