A Vendor’s Leaked Access Key Sat on a Public Website for 14 Months, Exposing 238,000 Denver Health Plan Members
Denver Health Medical Plan is notifying 238,083 people after an access key belonging to analytics vendor SquareML was left on a public website for about 14 months. Here are the facts, the timeline and what businesses that share data with vendors should check.
No one broke down a door in this case. A key to a health plan’s data was simply left out in public, and it stayed there for well over a year before the health plan was told. The facts below come from SecurityWeek’s report on the notification.
Fact file
- Organization: Denver Health Medical Plan (DHMP), a nonprofit managed care organization within the Denver Health and Hospital Authority. It administers Health First Colorado, the state’s Medicaid program, through Denver Health Medicaid Choice for members in Denver and three nearby counties.
- People notified: 238,083.
- Vendor: SquareML, a no-code healthcare analytics platform.
- What leaked: an access key that was accidentally exposed on a publicly accessible website.
- Type of access: a read-only account. According to DHMP, it could not be used to download, export, delete or change data.
- Data involved: names, dates of birth, ZIP codes, cities, states, demographic details, health metrics, eligibility data, hospital admission information, provider names, and discharge and transfer data.
- Not involved: Social Security numbers and financial information.
- Evidence of misuse: none found, according to DHMP.
The exposure window
- June 27, 2025: The access key is published on a public website.
- August 14, 2026: SquareML tells DHMP about the leak.
- August 18, 2026: The key is revoked. In response to the incident, passwords were reset for every account with access to the database, and DHMP and SquareML say they are pursuing more fixes.
- Late October 2026: DHMP is notifying affected members.
That is nearly 14 months during which anyone who found the key could have used it. Read-only access still allows someone to look at data, which is why DHMP is notifying members even though it found no evidence the data was viewed or misused.
The gaps this exposes
- Secrets in public places. Access keys and passwords end up in public code repositories, websites and shared documents more often than most companies realize.
- Long-lived keys. A key that never expires stays useful to whoever finds it, for as long as it exists.
- Vendor visibility. The health plan learned about the problem only when its vendor told it, more than a year later.
What this means for your company
If you share customer or employee data with an analytics, payroll, marketing or software vendor, their security mistakes become your notification letters. Ask vendors how they store and rotate access keys, whether they scan their code and websites for exposed secrets, and how quickly they will tell you if something leaks. On your own side, give vendors only the data and access they need, set keys and tokens to expire, and check your own websites and code repositories for passwords or keys that should not be there.
Want help reviewing what your vendors can reach and how their access is protected? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
