SquareML leaked access key exposes data of 238,083 Denver Health Medical Plan members for about 14 months
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 28/10/2026 00:04; os links antigos trazem para cá.
Fontes: securityweek.com ↗ hipaajournal.com ↗
Denver Health Medical Plan (DHMP) is notifying 238,083 current and former members that their personal and health data may have been exposed through its vendor SquareML, a no-code healthcare analytics/AI-ML provider. An access key to a SquareML-maintained database was inadvertently posted on a public website on June 27, 2025 and stayed online until it was revoked on August 18, 2026, an exposure window of roughly 14 months (securityweek.com, hipaajournal.com). SquareML notified DHMP on August 14, 2026. DHMP has no evidence that data was viewed or misused, only that it may have been. DHMP administers Health First Colorado (Medicaid) benefits through its Denver Health Medicaid Choice plan (securityweek.com). The original hipaajournal.com report also covered two unrelated healthcare incidents: Johns Hopkins Bayview Medical Center and BASS Medical Group.
Detalhes técnicos
- Credential scope: the leaked key gave read-only access, so downloading, exporting, deleting or altering data was not possible, according to DHMP (securityweek.com, hipaajournal.com).
- Potentially exposed data: full names, city/state/ZIP, demographic information, dates of birth, health plan eligibility, provider names, admission/discharge/transfer information, and health metrics such as BMI, HbA1c and eGFR (hipaajournal.com, securityweek.com). Social Security numbers and financial information were not in the database. Notification letters were mailed by DHMP (hipaajournal.com).
- Johns Hopkins Bayview Medical Center (Baltimore, MD): an employee uploaded a spreadsheet to a public AI tool not approved for staff use, affecting 3,182 patients treated between May and September 2026. It was identified on September 21, 2026. Data: names, admission/treatment dates, department, account numbers, medical record numbers, medications and treating provider names. The employee deleted the prompt and thread, the provider was asked to delete the data, and affected individuals were offered 12 months of credit monitoring (hipaajournal.com).
- BASS Medical Group (Walnut Creek, CA): suspicious network activity was identified on September 4, 2026, and unauthorized access was confirmed on September 22, 2026. Medical treatment codes, billing information and health insurance information may have been viewed or acquired. Letters began mailing on October 22, 2026, and the California Attorney General was notified. The number of victims was not disclosed (hipaajournal.com).
Remediação
- The leaked SquareML access key was deactivated/revoked on August 18, 2026 (hipaajournal.com, securityweek.com).
- Passwords for all accounts with access to the database were reset; DHMP and SquareML are pursuing additional remedial actions (securityweek.com).
- Johns Hopkins Bayview gave staff additional training on permitted AI platforms, and BASS Medical Group implemented additional safeguards (hipaajournal.com).
- Defenders should scan public repositories and websites for exposed secrets, audit vendor credential hygiene, and enforce policy on approved AI tools (hipaajournal.com).
Linha do tempo
-
SquareML Leaked Access Key Exposes Data of 238,083 Denver Health Medical Plan Members
ler a análise desta fonte ocultar
Denver Health Medical Plan (DHMP) is notifying 238,083 members that their personal and health information may have been exposed through its third-party vendor SquareML, a no-code healthcare analytics provider. SquareML told DHMP on August 14, 2026 that an access key had been inadvertently published on a publicly accessible website. The key was online from June 27, 2025 until it was revoked on August 18, 2026, an exposure window of roughly 14 months. DHMP has no evidence that member data was viewed or misused, only that it may have been.
Technical Details
- The leaked credential gave read-only access to a SquareML-maintained database. According to DHMP, it could not be used to download, export, delete or change data.
- Potentially exposed data: names, dates of birth, ZIP codes, city, state, demographic information, health metrics, health plan eligibility data, hospital admission, provider name, and discharge and transfer data.
- The database did not hold Social Security numbers or financial information.
- DHMP administers Health First Colorado (Medicaid) benefits through its Denver Health Medicaid Choice plan.
Remediation
- The access key was revoked on August 18, 2026.
- Passwords for all accounts with access to the database were reset.
- DHMP and SquareML are pursuing additional remedial actions.
-
Denver Health Medical Plan discloses SquareML vendor key leak exposing 238K members; Johns Hopkins Bayview and BASS Medical also report incidents
ler a análise desta fonte ocultar
Denver Health Medical Plan notified 238,083 current and former members of a breach tied to its vendor SquareML, an AI/ML analytics provider. An access key to a vendor-maintained database was inadvertently posted on a public website on June 27, 2025 and stayed exposed for more than a year. Denver Health was notified on August 14, 2026, and the key was deactivated on August 18, 2026. No evidence of misuse has been identified. The article also covers two other healthcare incidents: Johns Hopkins Bayview Medical Center (3,182 patients, staff upload of a spreadsheet to an unapproved public AI tool) and BASS Medical Group (unauthorized network access, number of victims not disclosed).
Technical Details
- Denver Health Medical Plan / SquareML: the leaked key was read-only, so downloading, exporting, deleting or altering data would not have been possible. Exposed data: full names, city/state/zip, demographic information, dates of birth, health plan eligibility, provider names, admission/discharge/transfer information, and health metrics such as BMI, HbA1c and eGFR. Social Security numbers and financial information were not exposed. Notification letters were mailed by Denver Health Medical Plan.
- Johns Hopkins Bayview Medical Center (Baltimore, MD): an employee uploaded a spreadsheet to a public AI tool not approved for staff use. It was identified on September 21, 2026 and covered patients treated between May and September 2026. Data: names, admission/treatment dates, department, account numbers, medical record numbers, medications and treating provider names. The employee deleted the prompt and thread, and the provider was asked to delete the data. Affected individuals were offered 12 months of credit monitoring.
- BASS Medical Group (Walnut Creek, CA): suspicious network activity was identified on September 4, 2026. On September 22, 2026 the investigation confirmed unauthorized access. Data possibly viewed or acquired: medical treatment codes, billing information and health insurance information. Letters began mailing on October 22, 2026, and the California Attorney General was notified.
Remediation
- The leaked SquareML access key was deactivated on August 18, 2026.
- Johns Hopkins Bayview gave staff additional training on permitted AI platforms.
- BASS Medical Group implemented additional safeguards.
- Defenders should scan public repositories and websites for exposed secrets, audit vendor credential hygiene, and enforce policy on approved AI tools.