Paradigm Healthcare Services, a San Francisco company that processes billing for California's Medi-Cal program, has told the U.S. Department of Health and Human Services that more than 970,000 individuals were affected by a breach of its local network, according to SecurityWeek's October 20, 2026 report on the company's HHS Office for Civil Rights filing. Paradigm's notice says files that may have been accessed contained names, dates of birth, gender and Medi-Cal member ID numbers.
Notification letters to affected people are dated September 14, 2026, which SecurityWeek puts at roughly 11 months after the intrusion was detected.
Who Paradigm is and why it held Medi-Cal data
In its breach notice, Paradigm describes itself as a third-party service provider that handles Medi-Cal billing and Medi-Cal member ID numbers under a Data Use Agreement with the California Department of Health Care Services (DHCS), the state agency that runs Medi-Cal.
The notice states that Paradigm's Student Health Network (SHN) platform was not affected.
What happened
According to the notice, Paradigm became aware of unauthorized access to its local network on October 13, 2025. The company says it took systems offline, notified law enforcement and engaged outside incident response professionals.
On August 18, 2026, about ten months after detection, Paradigm determined that "certain files containing select individuals' protected health information may have been accessed" between October 8 and October 15, 2025. That window opens five days before the October 13 detection and closes two days after it.
The data elements listed in the notice are:
- Name
- Date of birth
- Gender
- Medi-Cal member ID number
"We have no evidence that any of your information has been used to commit fraud or identity theft," Paradigm said in its notice.
What is known, and what is not
SecurityWeek points out three gaps in the disclosure:
- The attacker. The notice does not name a threat actor, and SecurityWeek reports that no known cybercrime group appears to have taken credit for the attack.
- The entry point. The notice does not explain how the unauthorized party got into the network.
- Exfiltration. The notice says files "may have been accessed" but does not say whether data was taken from the network.
Other large filings on the HHS tracker
SecurityWeek also covered two other sizable incidents reported to HHS:
- Tarter Krinsky & Drogin, a law firm that serves healthcare providers, told HHS that more than 196,000 individuals were affected. SecurityWeek reports the firm detected suspicious activity on its network in September 2025 and that its investigation, completed about a year later, found attackers accessed certain servers between July 9 and September 9, 2025. The firm began notifying individuals in early September 2026.
- Ridgeway Pharmacy told HHS that more than 258,000 individuals were affected. According to SecurityWeek, the pharmacy discovered unauthorized access to personal information on August 21, 2026, found that its website had been hacked, and began sending notices on September 21, 2026. The attacker may have accessed names, addresses, dates of birth, health and insurance information, prescription information and payment card information.
What affected members can do
Paradigm has set up a call center at 1-833-851-9382, staffed 5 a.m. to 5 p.m. Pacific time, Monday through Friday, excluding holidays. For medical identity protection, the notice advises sharing insurance cards only with health care providers and covered family members or others who help with their care, reviewing the explanation of benefits statements sent by the health insurer, and requesting a year-to-date report of paid services from the insurer. It also recommends a free one-year fraud alert, which can be placed with any one of the three credit bureaus, a free security freeze requested in writing from each bureau, and regular review of free credit reports from annualcreditreport.com for unfamiliar accounts or inquiries. Anyone who finds misuse is advised to file a police report and can file a complaint with the Federal Trade Commission.
What It Means for Defenders
- Inventory vendors that hold member identifiers. Health plans and agencies that share member ID numbers with billing contractors should confirm which vendors hold that data, under what agreement, and whether the agreement sets a deadline for the vendor to report a suspected intrusion to the data owner.
- Watch claims for misuse of member IDs. Organizations that process Medi-Cal claims can route anomalous activity on member IDs from the affected population for review.
- Prepare member support. Plans serving affected members should make it easy for members to report benefit statement entries they do not recognize.
- Verify counts at the primary source. Compliance and risk teams tracking third-party incidents should confirm Paradigm's entry on the HHS portal rather than relying on secondary reports.
