Overview
Paradigm Healthcare Services, a San Francisco company that processes billing for Medi-Cal (California's Medicaid program), has reported a data breach affecting more than 970,000 Medi-Cal members. The company detected the intrusion in October 2025 but only began notifying people roughly eleven months later.
Timeline
| Date | Event |
|---|---|
| Oct 8–15, 2025 | Window in which an unauthorized party may have accessed files |
| Oct 13, 2025 | Paradigm becomes aware of unauthorized access to its local network |
| Aug 18, 2026 | Paradigm determines which files may have been accessed |
| Sep 14, 2026 | Notification letters dated |
| ~Oct 20, 2026 | Breach reported publicly |
Data Involved
Paradigm operates under a data use agreement with the California Department of Health Care Services (DHCS) and maintains Medi-Cal member ID numbers on the department's behalf. The affected files contained:
- Names
- Dates of birth
- Gender
- Medi-Cal member identification numbers
Paradigm says its Student Health Network (SHN) platform, which handles online service documentation and billing, was not affected, and that it has no evidence the data was used for fraud or identity theft.
Open Questions
The notice does not name the threat actor, explain how the attackers got in, or say whether data was actually exfiltrated. Paradigm took affected systems offline, notified law enforcement, hired external incident response teams, and reported the breach to the US Department of Health and Human Services.
What Affected Members Should Do
- Watch for the notification letter and read it for enrollment details on any offered monitoring.
- Review Medi-Cal and insurance statements for services you did not receive.
- Be wary of unsolicited calls or messages that cite your Medi-Cal ID.
- Consider a credit freeze, although the exposed fields do not include Social Security numbers.
Takeaway
The case again shows the third-party risk in healthcare: a billing processor held a very large state program dataset. The long gap between detection and notification also shows how slow file-level review can be after an intrusion.