Denver Health Medical Plan (DHMP) says analytics vendor SquareML accidentally published an active access key on a public website on June 27, 2025. DHMP learned of it on Aug 14, 2026, and the key was turned off on Aug 18, 2026. It could have been used to read a SquareML database about DHMP's 238,083 members.

• Data: names, dates of birth, city, state, ZIP code, demographics, health measures such as BMI, HbA1c and eGFR, plan eligibility, provider names and hospital admission, discharge and transfer records. No Social Security or financial data.
• What DHMP says: the key was read-only, and it has no evidence the data was viewed or misused, only that it could have been. Passwords for all accounts with access were reset and letters have gone out.

Takeaway: a leaked read-only key is still a breach if it can read regulated data. Scan public sites, repos and paste sites for your vendors' keys as well as your own, and require vendors to expire keys rather than leave them live for over a year.