Paradigm Healthcare Breach Exposes Data of 970,000 Medi-Cal Members
San Francisco firm reports intrusion detected in October 2025 affected nearly one million California Medicaid enrollees with delayed notification.
Key points
- Unauthorized access occurred between October 8 and October 15, 2025.
- Compromised data includes names, dates of birth, gender, and Medi-Cal IDs.
- Notification letters were sent on September 14, 2026, nearly eleven months later.
Paradigm Healthcare Services reported to the US Department of Health and Human Services that a data breach affected more than 970,000 individuals. The San Francisco-based company, which processes billing for California’s Medi-Cal program, identified unauthorized access to its local network in October 2025.
The company determined on August 18, 2026, that files containing protected health information may have been accessed by an unauthorized party. This access window spanned from October 8 to October 15, 2025. Paradigm operates under a data use agreement with the California Department of Health Care Services and maintains member identification numbers on its behalf.
Incident Timeline and Response
Paradigm stated it became aware of the intrusion on October 13, 2025. However, the firm did not begin notifying affected individuals until September 14, 2026. This delay of roughly eleven months between detection and notification has drawn attention. The company confirmed its online service documentation and billing platform, Student Health Network, was not impacted by the intrusion.
According to SecurityWeek, no cybercrime group has claimed responsibility for the attack on Paradigm. The firm’s breach notification does not specify how attackers gained access or whether data was exfiltrated. It also does not name a specific threat actor. The notice lacks details on the initial vector used to compromise the local network.
Scope of Exposure
The compromised files contained names, dates of birth, gender, and Medi-Cal member identification numbers. These records belong to members of California’s Medicaid program. Paradigm stated there is no evidence that the information was used to commit fraud or identity theft. The company took certain systems offline and notified law enforcement after detecting the breach.
Outside incident response experts were brought in to assist with the investigation. The HHS healthcare data breach tracker was updated to reflect the significant number of affected individuals. This incident highlights the sensitivity of maintaining member identification numbers for state health programs.
Other Recent Healthcare Breaches
The HHS tracker also shows updates for separate incidents involving Tarter Krinsky & Drogin and Ridgeway Pharmacy Ltd. Tarter Krinsky & Drogin, a law firm serving healthcare providers, detected suspicious activity in September 2025. The firm completed its investigation one year later and found attackers accessed servers between July 9 and September 9, 2025.
Tarter Krinsky & Drogin reported that more than 196,000 individuals were affected by this incident. The firm began notifying individuals in early September 2026. Ridgeway Pharmacy discovered unauthorized access to personal information on August 21, 2026. The pharmacy started sending out data breach notices on September 21, 2026.
What should you do?
Organizations should monitor for delayed notifications from vendors handling sensitive health data. Reviewing access logs for unusual activity is critical during long investigation periods. That suggests prolonged detection times may increase risk exposure for stored data.
What to do and how to stay safe: Paradigm Healthcare
- Check your credit reports regularly for unauthorized inquiries or new accounts.
- Monitor bank and insurance statements for unfamiliar transactions or claims.
- Enable multi-factor authentication on all financial and health-related accounts.
- Consider placing a fraud alert or credit freeze with major credit bureaus.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people were affected by the Paradigm Healthcare breach?
More than 970,000 individuals were affected, according to the report filed with HHS.
What type of data was compromised in the Paradigm incident?
The compromised files contained names, dates of birth, gender, and Medi-Cal member identification numbers.
When did Paradigm notify affected individuals about the breach?
Notification letters were dated September 14, 2026, nearly eleven months after the intrusion was detected.
