970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach

What it is

Paradigm Healthcare Services, a San Francisco company that processes Medi-Cal billing for California's Department of Health Care Services (DHCS) under a data use agreement, reported a breach affecting more than 970,000 people to HHS. It also maintains Medi-Cal member ID numbers on the department's behalf. Two other breaches reported in the same article are Tarter Krinsky & Drogin (TKD) and Ridgeway Pharmacy.

Paradigm timeline

• October 8 to 15, 2025: window in which files may have been accessed.
• October 13, 2025: Paradigm became aware of unauthorized access to its local network.
• August 18, 2026: Paradigm determined that files with protected health information may have been accessed.
• September 14, 2026: date on the notification letters, about 11 months after detection.

The exposed fields are names, dates of birth, gender and Medi-Cal member IDs. Paradigm says its online documentation and billing platform, Student Health Network (SHN), was not affected. It took certain systems offline, notified law enforcement and hired outside incident response experts. It says it has no evidence of fraud or identity theft from the incident.

The other two breaches

• TKD (law firm serving healthcare providers): attackers accessed certain servers between July 9 and September 9, 2025. Suspicious activity was detected in September 2025, and the investigation finished a year later. Notices began in early September 2026. HHS lists more than 196,000 people.
• Ridgeway Pharmacy Ltd: discovered unauthorized access on August 21, 2026, and began sending notices on September 21. The attacker hacked the website and may have reached names, addresses, dates of birth, health and insurance information, prescription information and payment card information. HHS lists more than 258,000 people.

Caveats

The Paradigm notice does not name a threat actor, explain how attackers got in, or say whether data was exfiltrated. No known cybercrime group appears to have claimed the attack. Paradigm's wording is "may have been accessed", not confirmed theft. The article gives no intrusion details for TKD, and none beyond a hacked website for Ridgeway. It lists no remediation steps or indicators for any of the three.