Cybersecurity

Paradigm Healthcare Data Breach Affects 970,000 Medi-Cal Members

San Francisco-based Paradigm Healthcare Services has informed federal authorities that a security incident discovered last year potentially exposed the protected health information of nearly one million Medi-Cal members.

Radwan AbdulhadiEditor and technology writer

Published: October 20, 2026 · Updated: October 20, 2026 · 3 min read

Paradigm Healthcare Data Breach Affects 970,000 Medi-Cal Members — Image: SecurityWeek

Paradigm Healthcare Discloses Massive Medi-Cal Breach

Paradigm Healthcare Services has reported to the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people. San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf.

The company stated that it became aware of unauthorized access to its local network on October 13, 2025. According to details shared when [Paradigm said](https://paradigm-healthcare.com/notice), the firm determined on August 18, 2026, that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025.

Compromised Data and Notification Timeline

The compromised files exposed during the incident contained names, dates of birth, gender, and Medi-Cal member identification numbers. However, Paradigm noted that its online service documentation and billing platform, Student Health Network (SHN), was not impacted by the security event.

Paradigm’s notification letters are dated September 14, 2026, which is roughly 11 months after the initial intrusion was detected. The company noted that it is [notifying](https://oag.ca.gov/system/files/TKD%20-%20Notice%20of%20Data%20Event%20-%20CA_0.pdf) affected individuals while stating that it currently has no evidence that any information has been used to commit fraud or identity theft.

Response Efforts and Unnamed Threat Actors

The formal notifications sent out by the company do not name a threat actor, explain how attackers gained access, or specify whether data was successfully exfiltrated from the network. In response to the breach, Paradigm reported taking certain systems offline, notifying law enforcement agencies, and bringing in outside incident response experts to handle the investigation.

As security teams continue analyzing various incidents across the sector, detailed updates regarding healthcare security events are regularly tracked on the [SecurityWeek](https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/) portal. Furthermore, no known cybercrime group appears to have publicly taken credit for an attack against Paradigm at this time.

Additional Healthcare Incidents Tracked by HHS

The [HHS healthcare data breach tracker](https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf) has also been updated to reflect significant numbers of individuals affected by separate security incidents recently disclosed by other entities in the healthcare supply chain.

Law firm Tarter Krinsky & Drogin (TKD), which provides services to healthcare providers, began notifying individuals in early September after detecting suspicious network activity in September 2025. After completing its investigation a year later, TKD determined that attackers accessed servers between July 9 and September 9, 2025, impacting more than 196,000 individuals.

Ridgeway Pharmacy Breach Disclosures

In addition to the Paradigm and TKD incidents, public disclosures reveal that [Ridgeway Pharmacy](https://oag.ca.gov/system/files/CA%20-%20Adult%20-%20Redacted.pdf) also suffered a significant breach. The company started sending out data breach notices on September 21 after discovering unauthorized access to personal information on August 21, 2026.

Ridgeway Pharmacy discovered that its website had been hacked, potentially exposing names, addresses, dates of birth, health and insurance information, prescription data, and payment card details. The organization informed the HHS that more than 258,000 individuals were affected by the website intrusion.