SquareML
14 August 2026, by an independent security researcher.
Read-only — the key could not change or delete any information.
238,083 DHMP members: names, dates of birth, demographic details and plan eligibility. No Social Security numbers or financial information.
18 August 2026: key revoked and credentials reset for every account with access. No other clients affected.
What happened
On 14 August 2026, an independent security researcher responsibly reported that an access key for a database supporting our clients, Denver Health Medical Plan (DHMP), had been accidentally published in a code repository.
The key gave read-only access and could not be used to change or delete any information. The database held information on 238,083 DHMP members, including names, dates of birth, demographic details and plan eligibility information. It did not contain Social Security numbers or financial information. No other clients were affected.
What an access key is, and why it matters
An access key is a long, secret string that lets one piece of software prove who it is to another — in this case, to read from a database. It works like a password for systems rather than people, which is why it should never appear in source code.
Code repositories are built to be copied, shared and kept: once a key is committed, it can stay in the repository’s history even after the line is deleted. That is why the right response to an exposed key is not just to delete it from the code, but to make it worthless.
Our response
- 18 August 2026: Revoked the exposed key and reset credentials for every account with access to the database.
- Reviewed and tightened access settings on our code repositories.
What revoking a key and resetting credentials means
- 01Revoke
The exposed key is switched off at the source, so any request that presents it is refused.
- 02Reset
Credentials are reset for every account with access to the database, not only the one that was exposed.
- 03Tighten
Access settings on the code repositories are reviewed so the same mistake is harder to repeat.
How we protect our systems
Centralized secrets management
All credentials are kept in a secure secret manager, with strict policies that keep them out of code.
Continuous monitoring
We watch database and application access around the clock, including who connects, from where and what data is requested.
Keeping credentials in a secret manager means applications receive them when they run, rather than reading them from source code. Strict policies keep keys out of code in the first place, so a repository never needs to hold one.
Watching database and application access around the clock — who connects, from where and what data is requested — means unusual activity stands out against the normal pattern and can be acted on quickly.
More about how the platform is secured — AWS, Amazon EKS, Amazon Bedrock, encryption and access — is on our Security page.
Our commitment
Security is an ongoing commitment, and we keep reviewing and strengthening our safeguards.
We build HIPAA-compliant AI for regulated industries, where data is complex and the stakes are high.
Automation handles the routine work; experts review the judgment calls.
Security is an ongoing commitment. We keep reviewing and strengthening our safeguards.
Questions and answers
What happened in the SquareML security incident?
On 14 August 2026, an independent security researcher responsibly reported that an access key for a database supporting our client Denver Health Medical Plan (DHMP) had been accidentally published in a code repository.
Was there a SquareML data breach or data leak?
An access key for a database supporting Denver Health Medical Plan (DHMP) was accidentally published in a code repository and reported to us on 14 August 2026 by an independent security researcher. The key gave read-only access. On 18 August 2026 we revoked it and reset credentials for every account with access to the database.
What information was in the database?
Information on 238,083 DHMP members, including names, dates of birth, demographic details and plan eligibility information. It did not contain Social Security numbers or financial information.
Could the key be used to change or delete information?
No. The key gave read-only access and could not be used to change or delete any information.
Were other SquareML clients affected?
No other clients were affected.
Does the exposed key still work?
No. On 18 August 2026 we revoked the exposed key and reset credentials for every account with access to the database.
What has SquareML changed since?
We reviewed and tightened access settings on our code repositories. All credentials are kept in a secure secret manager, with strict policies that keep them out of code.
How does SquareML watch for unusual access?
We watch database and application access around the clock, including who connects, from where and what data is requested.
Who can I contact with questions about this notice?
Contact us through squareml.ai/contact or email sales@squareml.ai.
Published Nov 1, 2026.
