Denver Health Medical Plan says a vendor's access key sat on a public website for over a year, putting records of 238,083 members within reach.
Denver Health Medical Plan is notifying 238,083 current and former members that a digital key to their records sat on a public website for more than a year. The key belonged to a vendor, SquareML, which runs an artificial intelligence analytics platform. The plan has found no sign the key was misused, but the details involved are personal.
An access key works like a password that lets software into a database. SquareML added one to a public website by mistake on June 27, 2025. Denver Health Medical Plan was told about it on August 14, 2026, and the key was deactivated on August 18, 2026. The plan, a Denver non-profit affiliated with the Denver Health and Hospital Authority, is mailing the notification letters itself.
Financial information and Social Security numbers were not exposed.
The plan says it has not found evidence the key was misused. The key gave read-only access, so it could not have been used to download, export, delete or alter data. Even so, health details are the kind of thing a scammer can use to sound convincing, so the risk is not zero.
Johns Hopkins Bayview Medical Center in Baltimore says a staff member uploaded a spreadsheet on 3,182 patients to a public AI tool the center had not approved. It was caught on September 21, 2026. The data included names, medications, medical record numbers and treating provider names. The center asked the tool's provider to delete it and offered 12 months of free credit monitoring.
BASS Medical Group in Walnut Creek, California, found suspicious network activity on September 4, 2026. By September 22 it confirmed unauthorized access. Treatment codes, billing information and health insurance information may have been taken. Letters began going out on October 22, 2026. The number of people affected has not been made public.
The alert box above lists the steps. The main idea is simple: your records are only as safe as the vendors your plan or clinic shares them with. Read any letter you get, and be careful with calls or emails that mention your health. For business owners, the Hopkins case is a reminder to set clear rules on which AI tools staff may use.
If a health plan or clinic sends you a breach letter, keep it, check your statements, and be wary of anyone using your health details.
Reports say the Trump administration is weighing underwater datacenters off Maine and Alaska, and Lake Erie groups want a plan before anyone proposes one nearby.
Read more: Underwater datacenters may be next, and Lake Erie groups are worriedA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
