Paradigm breach may expose data of more than 970,000 Medi-Cal members

Paradigm Healthcare Services reported to the U.S. Department of Health and Human Services that files containing personal information of more than 970,000 Medi-Cal members may have been accessed during a cyber intrusion in October 2025.

The San Francisco-based company processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services. Paradigm maintains Medi-Cal member identification numbers for the department.

The company detected unauthorized access to its local network on Oct. 13, 2025. On Aug. 18, 2026, Paradigm determined that an unauthorized party may have accessed certain files between Oct. 8 and Oct. 15, 2025.

The files contained names, dates of birth, genders and Medi-Cal member identification numbers. Paradigm’s Student Health Network online service documentation and billing platform was not affected.

The company’s notification letters are dated Sept. 14, 2026, about 11 months after the intrusion was detected. The notices state that Paradigm has no evidence the information was used to commit fraud or identity theft.

Paradigm did not identify the attacker or explain how the network was accessed. The company did not disclose whether information was removed from its systems. It took certain systems offline, notified law enforcement and hired outside incident-response specialists.

The HHS healthcare data breach tracker lists separate incidents involving Tarter Krinsky & Drogin and Ridgeway Pharmacy Ltd. Tarter Krinsky & Drogin, a law firm that serves healthcare providers, began notifying individuals in early September after detecting suspicious network activity. Its investigation found that attackers accessed certain servers between July 9 and Sept. 9, 2025. The firm reported that more than 196,000 people were affected.

Ridgeway Pharmacy discovered unauthorized access to personal information on Aug. 21, 2026, after its website was hacked. The information may have included names, addresses, dates of birth, health and insurance details, prescription information and payment card data. The pharmacy began sending breach notices on Sept. 21 and reported that more than 258,000 people were affected.