Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk

SecurityWeek reports that the data breach, DHMP says, involved third-party vendor SquareML, which provides a no-code platform for healthcare analytics.[1] SecurityWeek describes DHMP as a non-profit managed care organization within the Denver Health and Hospital Authority system.[1]SecurityWeek says that, according to DHMP's incident notice, SquareML notified the health plan administrator on August 14, 2026, that an access key was inadvertently leaked on a publicly accessible website.[1]Hoodline reports that, according to the HIPAA Journal, the key was added to the public site on June 27, 2025, and remained live for more than a year.[2] Hoodline adds that DHMP deactivated it four days later, on August 18, 2026.[2]Class Action U reports that the plan lists the exposed data as full name, date of birth, city, state, ZIP code, demographic information, health metrics (BMI, HbA1c, eGFR), health plan eligibility data[3], along with provider names and hospital admission, discharge and transfer details. The outlet says that Social Security numbers and financial information were not included, according to the plan.[3]Hoodline reports that the plan says the compromised account was read-only.[2]Class Action U reports that, according to DHMP, passwords were reset for every account with access to the database[3], and the plan is looking at further fixes with the vendor. The outlet notes that the plan has not said whether it can confirm that no one accessed the database, whether it is offering credit monitoring or identity protection[3].Hoodline reports that, citing Claim Depot, the breach was reported to the U.S. Department of Health and Human Services on October 1, 2026.[2]