# Paradigm Healthcare Data Breach Exposes 970,000 Medi-Cal Members

- URL: https://usa-24.com/paradigm-healthcare-data-breach-medi-cal/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-22T20:01:26.041Z
- Updated: 2026-10-22T20:01:26.048Z
- Topics: Data Breach, Medi-Cal, Health Data Privacy, Medicaid, California

> A California Medi-Cal billing vendor says an October 2025 intrusion may have exposed data of more than 970,000 members, and notice letters went out only in September.

## Key takeaways

- Paradigm Healthcare Services told federal regulators that an October 2025 intrusion may have exposed data of more than 970,000 Medi-Cal members.
- The exposed files reportedly contained names, dates of birth, gender and Medi-Cal member ID numbers, and the company says it has no evidence the information has been used for fraud.
- Paradigm found unauthorized access on October 13, 2025, but its notification letters are dated September 14, 2026, roughly 11 months later.
- The company has not named an attacker or explained how access was gained, and no known cybercrime group has claimed the attack.
- Members should verify any letter through the contact details on the notice or the Medi-Cal website, and check statements for claims they do not recognize.

Paradigm Healthcare Services, a San Francisco company that processes billing for California's Medi-Cal program, has told federal health regulators that an intrusion last October may have exposed the personal data of more than 970,000 people. The Paradigm Healthcare data breach resurfaced this week in a federal filing, but the attack itself is about a year old. The breach first went public through notice letters in September, and the new count shows how large the exposure could be.

## What the Paradigm Healthcare data breach exposed

Paradigm keeps Medi-Cal member ID numbers on behalf of the California Department of Health Care Services (DHCS) under a data use agreement. [SecurityWeek](https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/) reported that the company told HHS more than 970,000 people may have been affected. The files that may have been accessed contained names, dates of birth, gender and Medi-Cal member ID numbers, according to [CloudLink Tech](https://www.cloudlinktech.com/news/paradigm-breach-may-expose-data-of-970000-medi-cal-members/).

The member ID deserves attention. It links a person to a benefits record, and a name, birth date and ID together give someone enough material to attempt a fraudulent claim. In its letters, as quoted by SecurityWeek, Paradigm says it has "no evidence that any of your information has been used" for fraud or identity theft. That is a reassuring line, but it describes what the company has found so far, not what it can guarantee.

PParadigm also says its Student Health Network billing platform was not affected. That narrows the picture, but the company says it is still confirming the affected population, so the count could move.

## A timeline that stretches close to 11 months

Paradigm says it became aware of unauthorized access to its local network on October 13, 2025. Its review, completed August 18, 2026, found that files may have been accessed between October 8 and October 15, 2025. The notification letters are dated September 14, 2026.

| Date | What happened |
|---|---|
| October 8 to 15, 2025 | Window in which files may have been accessed |
| October 13, 2025 | Paradigm becomes aware of unauthorized access to its local network |
| August 18, 2026 | Paradigm completes its review |
| September 14, 2026 | Notification letters are dated |

That works out to roughly 11 months between detection and notice. A law-firm blog at [databreachclassaction.io](https://databreachclassaction.io/cases/california-dhcs-paradigm-healthcare-services-data-breach-class-action-investigation) counts 336 days between discovery and notice. That figure is the firm's own calculation, not a number the company gave.

Paradigm's [public notice](https://paradigm-healthcare.com/notice) says the company took systems offline, notified law enforcement and brought in outside incident response specialists. The notice describes the response with the words "we took steps to mitigate the incident." It does not name the attacker or explain how the intruders got in. No known cybercrime group has claimed the attack, according to SecurityWeek's reporting.

## How the Paradigm Healthcare data breach fits Black October

Security coverage this week grouped a run of disclosures under the "Black October" label. [SecurityToday](https://www.securitytoday.de/en/2026/10/22/black-october-many-attacks-had-been-running-for-months/) reported that many of those attacks had been running for months before they became public. Paradigm fits that pattern: the access window lasted one week in October 2025, yet the notice reached members nearly 11 months after the company found the activity.

The same reporting covers a separate California student-data case involving ETS. In that incident, copying ran from May 22 to September 18, 2026, the activity was discovered September 25, and notifications began October 16. USA 24 has already covered that case.

Paradigm is a third-party vendor, not the state agency itself. That distinction matters for patients, who never chose Paradigm and may not know it holds their records. A data use agreement sets the rules for how a vendor handles that data, but the records still sit on a private company's network, where a single intrusion can reach people who never dealt with that company directly.

USA 24 has also reported on other vendor-side exposures, including the [PingCAP breach](https://usa-24.com/pingcap-data-breach-tidb-cloud/), which exposed TiDB Cloud billing records and API keys. The sources reviewed do not tie the Paradigm attack to any gang. They do note the [SafePay ransomware](https://usa-24.com/safepay-ransomware-600-victims/) group, which the FBI and CISA have warned has hit more than 600 organizations.

## Who is affected and what could still change

The core group is California Medi-Cal members whose billing or member ID records passed through Paradigm. The company describes its work as billing support for school-based services, which could also bring in families linked to school-based Medi-Cal care, according to [Class Action U](https://classactionu.org/current-data-breaches/paradigm-healthcare-services/).

A law-firm blog suggests a separate notice for minors may exist, because the letter filed with California appears to be the adult version. Neither the company nor a regulator has confirmed that. The same firm's investigation notes that a class-action investigation of the DHCS and Paradigm breach was opened in September 2026, before the HHS figure surfaced. An investigation is not a lawsuit, and the sources reviewed do not show that one has been filed.

Sources also disagree on when the HHS report was filed. Some date it to around October 12, and others to October 20, 2026. The reporting reviewed for this story does not settle which date is correct.

## What Medi-Cal members should do now

1. Verify any letter before you act. Use the contact details printed on the notice or listed on the Medi-Cal website, not numbers in an unsolicited call or email.
2. Check explanation-of-benefits forms and provider statements for services you do not recognize, and report anything odd to your plan or provider.
3. Watch for signs of medical identity theft, such as bills for care you never received or insurance claims you do not recognize.
4. Ask your provider whether a claim was submitted in your name if something looks wrong.
5. Consider a free credit freeze with Equifax, Experian and TransUnion. The sources do not address this step, but it is standard practice for people worried about identity theft.

## What to watch next

Several questions remain open. Paradigm has not named the attacker or the initial access method, and it has not confirmed whether data was definitively taken. It is also unknown whether California or HHS will open an enforcement or audit action, or whether the class-action investigation becomes a filed case.

The next useful signal is whether the 970,000 figure holds once Paradigm finishes confirming who was affected. Watch for a minors notice, any statement from DHCS, and a settled date for the HHS filing. Members who received letters should keep them and review their statements over the coming months, because fraud tied to a benefits record can surface on a bill long after a breach is announced.

## Frequently asked questions

### Was my information in the Paradigm Healthcare data breach?

Paradigm reported to HHS that more than 970,000 people may have been affected, and the company says it is still confirming the affected population. Notification letters are dated September 14, 2026, so check your mail for that letter. Verify it using the contact details on the notice or the Medi-Cal website before you respond.

### Did the Paradigm Healthcare breach expose passwords or bank details?

The sources reviewed list names, dates of birth, gender and Medi-Cal member ID numbers as the exposed categories. None of the reporting says that bank account numbers or passwords were in the affected files. The company has not explained how the intruders gained access, so the full scope is still unclear.

### Is there a Paradigm Healthcare Services lawsuit?

A class-action investigation of the DHCS and Paradigm breach was opened in September 2026, according to databreachclassaction.io. An investigation is not the same as a filed lawsuit. The sources reviewed do not show that a suit has been filed yet.

### Why did it take 11 months to notify Medi-Cal members?

Paradigm says it became aware of unauthorized access on October 13, 2025, and completed its review on August 18, 2026. Its notification letters are dated September 14, 2026. The sources reviewed do not explain the gap between the completed review and the letters.

### What should I do if I received a Medi-Cal breach letter?

Confirm the letter using contact details printed on the notice or listed on the Medi-Cal website, not numbers in an unsolicited call or email. Review explanation-of-benefits forms for services you did not receive, and ask your provider whether a claim was filed in your name. A free credit freeze with each major credit bureau is a common step for people worried about identity theft.

## Sources

1. [970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach - SecurityWeek](https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/)
2. [Paradigm Healthcare Data Breach Exposes Personal Information of Over 970,000 Medi-Cal Members - OODAloop](https://oodaloop.com/briefs/cyber/paradigm-healthcare-data-breach-exposes-personal-information-of-over-970000-medi-cal-members)
3. [Paradigm breach may expose data of more than 970,000 Medi-Cal members - CloudLink Tech](https://www.cloudlinktech.com/news/paradigm-breach-may-expose-data-of-970000-medi-cal-members/)
4. [Notice of Data Breach - Paradigm Healthcare Services](https://paradigm-healthcare.com/notice)
5. [Paradigm Healthcare Services Data Breach - Class Action U](https://classactionu.org/current-data-breaches/paradigm-healthcare-services/)
6. [Black October: Many attacks had been running for months - SecurityToday](https://www.securitytoday.de/en/2026/10/22/black-october-many-attacks-had-been-running-for-months/)
7. [California DHCS / Paradigm Healthcare Services Data Breach Class Action Investigation - databreachclassaction.io](https://databreachclassaction.io/cases/california-dhcs-paradigm-healthcare-services-data-breach-class-action-investigation)