PARADIGM Healthcare Services has disclosed a data breach affecting more than 970,000 Medi-Cal members, California’s Medicaid programme. The San Francisco-based company, which processes billing for Medi-Cal under a data use agreement with the California Department of Health Care Services (DHCS), said unauthorized access to its local network was detected on 13 October 2025.
It was later determined, on 18 August 2026, that certain files containing individuals’ protected health information may have been accessed between 8 and 15 October 2025. The compromised data included names, dates of birth, gender, and Medi-Cal member identification numbers. Paradigm noted that its online service documentation and billing platform, the Student Health Network (SHN), were not affected.
Notification letters to affected individuals were issued on 14 September 2026, around 11 months after the intrusion was detected. The firm stated there is no evidence that any information has been used to commit fraud or identity theft, but it did not name the attacker, explain the method of access, or confirm exfiltration. Paradigm reported that some systems were taken offline, law enforcement was notified, and outside incident-response experts were engaged.
The HHS breach tracker shows concurrent disclosures from other healthcare organisations, including TKD (affecting more than 196,000 individuals) and Ridgeway Pharmacy (more than 258,000 individuals) in related, separate incidents. The article notes no attribution of these events to a known cybercrime group.