Paradigm Healthcare Services Data Breach Exposes Nearly One Million Medi-Cal Members
Paradigm Healthcare Services has disclosed a data breach affecting approximately 970,000 Medi-Cal members, with sensitive personal and health information compromised.
Paradigm Healthcare Services has notified the US Department of Health and Human Services (HHS) of a significant data breach that impacted over 970,000 individuals. The breach, discovered in October 2025, led to unauthorized access to sensitive personal and health information of Medi-Cal members, California's state-funded health insurance program.
Based in San Francisco, Paradigm operates as a billing processor for Medi-Cal under an agreement with the California Department of Health Care Services (DHCS). The company also maintains Medi-Cal member identification numbers on behalf of the state.
Paradigm first detected unauthorized access to its local network on October 13, 2025. A subsequent investigation concluded on August 18, 2026, revealing that certain files containing protected health information may have been accessed by an unauthorized party between October 8 and October 15, 2025. The compromised data included names, dates of birth, gender, and Medi-Cal member identification numbers. The company emphasized that its online service documentation and billing platform, Student Health Network (SHN), remained unaffected.
Notification letters to affected individuals were dated September 14, 2026, nearly a year after the intrusion was initially detected. Paradigm stated that it has found no evidence of fraud or identity theft resulting from the incident. However, the notification did not specify the threat actor responsible, the method of initial access, or confirm whether data was exfiltrated.
In response to the breach, Paradigm reported taking certain systems offline, alerting law enforcement, and engaging external incident response specialists. As of the disclosure, no known cybercrime group has claimed responsibility for an attack on Paradigm.
This incident adds to a growing list of data breaches affecting the healthcare sector. The HHS healthcare data breach tracker has recently been updated with other notable incidents, including breaches at the law firm Tarter Krinsky & Drogin (affecting over 196,000 individuals) and Ridgeway Pharmacy Ltd. (impacting more than 258,000 individuals), both of which also involved unauthorized access to sensitive personal and health information.
The delay in notification, nearly a year after detection, raises concerns about the timeliness of breach disclosures and the potential for prolonged exposure of sensitive data. The scale of the Paradigm breach underscores the persistent cybersecurity challenges faced by healthcare organizations and their business associates, highlighting the critical need for robust security measures and prompt incident response.
This breach serves as a stark reminder of the value of healthcare data to threat actors and the ongoing risks to patient privacy. Organizations handling protected health information must maintain vigilant security practices and ensure compliance with data breach notification regulations.