Leaked Access Key Exposes Denver Health Plan Member Data via Vendor

Key points

• A leaked credential at an unidentified vendor enabled database access.
• Denver Health Plan reports roughly 238,000 members in scope.
• Exposed records include personal details and health information.
• No CVE is associated; the issue is credential and access control.

Denver Health Plan and SquareML are tied to a data exposure in which an unidentified vendor's leaked access key was used to reach a database. The affected repository held personal details and health information for approximately 238,000 members. No CVE identifier is linked to the event, which points to credential handling and access control rather than a named software flaw.

The core issue is simple and serious: a credential that should have been protected became available, and that credential opened a path into stored member records. Whether the key was exposed through a repository, configuration error, or vendor system is not established in the facts, so responders should treat the scope as unconfirmed until logs and database queries are reviewed.

For members, the risk centers on identity and health privacy. Health data can enable targeted phishing, insurance fraud, or discrimination if misused, while personal identifiers raise account-takeover concerns. For the plan and its vendor relationships, the event raises questions about third-party key lifecycle management, monitoring, and contractual security requirements.

This is not a patch-now CVE scenario. The priority is containment: revoke the key, find every system it could reach, preserve evidence, and determine which records were actually accessed. Watch for notification timelines, vendor cooperation, and whether other static keys or shared credentials exist in the same environment.

What to do now

1. Revoke and rotate the exposed access key immediately, then review its usage logs for unauthorized queries or data retrieval.
2. Map every database and service reachable by the credential, preserve relevant logs, and confirm which member records were actually accessed.
3. Replace static or long-lived keys with short-lived credentials and enforce least-privilege access for vendor integrations.
4. Enable alerting for anomalous database access, unusual key use, and bulk record reads tied to third-party accounts.
5. Engage privacy, legal, and incident response teams to assess notification duties for the roughly 238,000 affected members.
6. Require vendors to document key management, incident reporting timelines, and evidence of containment before restoring access.
7. Scan repositories and CI/CD systems for embedded secrets and add pre-commit controls to block future credential leaks.

Original source

SecurityWeek