Paradigm Healthcare breach exposes data of 970,000 Medi-Cal members

Paradigm Healthcare Services, a San Francisco-based company that processes billing for California's Medicaid program Medi-Cal, has told the US Department of Health and Human Services (HHS) that a data breach affected more than 970,000 people, SecurityWeek reported on October 20. Exposed information includes names, dates of birth, gender and Medi-Cal member identification numbers, and affected individuals were notified roughly 11 months after the intrusion was detected.

What happened

According to SecurityWeek, Paradigm works under a data use agreement with the California Department of Health Care Services (DHCS) and maintains Medi-Cal member identification numbers on the department's behalf. The company said it became aware of unauthorized access to its local network on October 13, 2025, and that certain files were accessed between October 8 and October 15, 2025.

Paradigm said it took certain systems offline, notified law enforcement and engaged outside incident response experts. Its review concluded on August 18, 2026, that files containing some individuals' protected health information may have been accessed. The notification letters to affected people are dated September 14, 2026.

Who is affected

The breach affects Medi-Cal members whose details were held by Paradigm. The company said its online service documentation and billing platform, Student Health Network (SHN), were not affected. According to its notice, Paradigm has no evidence that any of the information has been used to commit fraud.

The notice does not name the attacker, explain how access was gained or state whether data was exfiltrated, and SecurityWeek said no known cybercrime group has claimed the attack.

Other healthcare breaches

SecurityWeek noted that the same HHS breach tracker update included two other significant incidents. Law firm Tarter Krinsky & Drogin, which serves healthcare providers, reported more than 196,000 affected people after attackers accessed certain servers between July 9 and September 9, 2025. Ridgeway Pharmacy Ltd. reported more than 258,000 affected individuals after discovering on August 21, 2026, that its website had been hacked; data possibly accessed there includes health, insurance, prescription and payment card information.

What to do

Medi-Cal members who receive a notification letter should follow the instructions in it, review benefit statements and medical bills for services they did not receive, and be cautious of calls or messages that cite their Medi-Cal number to request further personal or financial information.