Breaches and incidents
Denver Health Medical Plan: AI vendor SquareML left an access key on a public website for over a year, 238,083 members exposed
Per HIPAA Journal, the plan notified 238,083 current and former members after being told on 14 Aug 2026 that an access key used by its AI/ML analytics...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Per HIPAA Journal, the plan notified 238,083 current and former members after being told on 14 Aug 2026 that an access key used by its AI/ML analytics vendor SquareML had been exposed; data included names, demographics, dates of birth, eligibility, provider names, admission/discharge/transfer data and health metrics such as HbA1c. SSNs and financial data were not exposed.
- Root cause: per the report, the vendor “inadvertently” added the key to a public website on 27 Jun 2025; it was deactivated on 18 Aug 2026 and gave read-only access.
- No attacker named; the plan said it found no evidence the key was misused.
- Notification letters have been mailed.