Paradigm Healthcare breach exposed data on about 970,000 Medi-Cal members
A data breach at Paradigm Healthcare Services hit more than 970,000 people, according to SecurityWeek. The company does billing work for Medi-Cal, which is California's Medicaid health program. Hackers may have seen names, birth dates, gender and Medi-Cal ID numbers in the breach.
A data breach at Paradigm Healthcare Services affected more than 970,000 people, according to SecurityWeek, citing the company's report to the US Department of Health and Human Services.
Paradigm, based in San Francisco, processes billing for Medi-Cal, California's Medicaid program, under an agreement with the state's Department of Health Care Services, SecurityWeek reported. It also keeps Medi-Cal member ID numbers on the department's behalf.
The company says it learned of unauthorized access to its local network on October 13, 2025. "On August 18, 2026, we determined that certain files containing select individuals' protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025," Paradigm said.
The files contained names, birth dates, gender and Medi-Cal member ID numbers, SecurityWeek reported. Paradigm said its Student Health Network billing platform was not affected.
The company's letters to people affected are dated September 14, 2026, about 11 months after it detected the intrusion, according to SecurityWeek. "We have no evidence that any of your information has been used to commit fraud or identity theft as a result of this incident," Paradigm said.
The notice does not name the attackers, explain how they got in or say whether data was taken off the network, SecurityWeek reported. Paradigm said it took some systems offline, notified law enforcement and hired outside experts. No known cybercrime group appears to have claimed the attack.
The HHS tracker of health data breaches also lists other recent incidents, SecurityWeek reported. A law firm that serves health care providers reported a breach affecting more than 196,000 people. Ridgeway Pharmacy reported one affecting more than 258,000.
What we know: Paradigm says files with data on more than 970,000 people may have been accessed in October 2025.
What we don't: Who carried out the attack. Only SecurityWeek has reported this so far; NewsHabit hasn't seen independent confirmation.
Where outlets agree SecurityWeek reports that Paradigm informed HHS the breach affected more than 970,000 people and exposed names, birth dates, gender and Medi-Cal IDs.
Where they differ SecurityWeek notes that Paradigm's notice does not say whether data was stolen, and Paradigm hasn't responded to that question in the report NewsHabit reviewed.