Paradigm Healthcare Services, a San Francisco company that processes billing for California's Medi-Cal program, has told federal health regulators that an intrusion last October may have exposed the personal data of more than 970,000 people. The Paradigm Healthcare data breach resurfaced this week in a federal filing, but the attack itself is about a year old. The breach first went public through notice letters in September, and the new count shows how large the exposure could be.
What the Paradigm Healthcare data breach exposed
Paradigm keeps Medi-Cal member ID numbers on behalf of the California Department of Health Care Services (DHCS) under a data use agreement. SecurityWeek reported that the company told HHS more than 970,000 people may have been affected. The files that may have been accessed contained names, dates of birth, gender and Medi-Cal member ID numbers, according to CloudLink Tech.
The member ID deserves attention. It links a person to a benefits record, and a name, birth date and ID together give someone enough material to attempt a fraudulent claim. In its letters, as quoted by SecurityWeek, Paradigm says it has "no evidence that any of your information has been used" for fraud or identity theft. That is a reassuring line, but it describes what the company has found so far, not what it can guarantee.
PParadigm also says its Student Health Network billing platform was not affected. That narrows the picture, but the company says it is still confirming the affected population, so the count could move.
A timeline that stretches close to 11 months
Paradigm says it became aware of unauthorized access to its local network on October 13, 2025. Its review, completed August 18, 2026, found that files may have been accessed between October 8 and October 15, 2025. The notification letters are dated September 14, 2026.
| Date | What happened |
|---|---|
| October 8 to 15, 2025 | Window in which files may have been accessed |
| October 13, 2025 | Paradigm becomes aware of unauthorized access to its local network |
| August 18, 2026 | Paradigm completes its review |
| September 14, 2026 | Notification letters are dated |
That works out to roughly 11 months between detection and notice. A law-firm blog at databreachclassaction.io counts 336 days between discovery and notice. That figure is the firm's own calculation, not a number the company gave.
Paradigm's public notice says the company took systems offline, notified law enforcement and brought in outside incident response specialists. The notice describes the response with the words "we took steps to mitigate the incident." It does not name the attacker or explain how the intruders got in. No known cybercrime group has claimed the attack, according to SecurityWeek's reporting.
How the Paradigm Healthcare data breach fits Black October
Security coverage this week grouped a run of disclosures under the "Black October" label. SecurityToday reported that many of those attacks had been running for months before they became public. Paradigm fits that pattern: the access window lasted one week in October 2025, yet the notice reached members nearly 11 months after the company found the activity.
The same reporting covers a separate California student-data case involving ETS. In that incident, copying ran from May 22 to September 18, 2026, the activity was discovered September 25, and notifications began October 16. USA 24 has already covered that case.
Paradigm is a third-party vendor, not the state agency itself. That distinction matters for patients, who never chose Paradigm and may not know it holds their records. A data use agreement sets the rules for how a vendor handles that data, but the records still sit on a private company's network, where a single intrusion can reach people who never dealt with that company directly.
USA 24 has also reported on other vendor-side exposures, including the PingCAP breach, which exposed TiDB Cloud billing records and API keys. The sources reviewed do not tie the Paradigm attack to any gang. They do note the SafePay ransomware group, which the FBI and CISA have warned has hit more than 600 organizations.
Who is affected and what could still change
The core group is California Medi-Cal members whose billing or member ID records passed through Paradigm. The company describes its work as billing support for school-based services, which could also bring in families linked to school-based Medi-Cal care, according to Class Action U.
A law-firm blog suggests a separate notice for minors may exist, because the letter filed with California appears to be the adult version. Neither the company nor a regulator has confirmed that. The same firm's investigation notes that a class-action investigation of the DHCS and Paradigm breach was opened in September 2026, before the HHS figure surfaced. An investigation is not a lawsuit, and the sources reviewed do not show that one has been filed.
Sources also disagree on when the HHS report was filed. Some date it to around October 12, and others to October 20, 2026. The reporting reviewed for this story does not settle which date is correct.
What Medi-Cal members should do now
- Verify any letter before you act. Use the contact details printed on the notice or listed on the Medi-Cal website, not numbers in an unsolicited call or email.
- Check explanation-of-benefits forms and provider statements for services you do not recognize, and report anything odd to your plan or provider.
- Watch for signs of medical identity theft, such as bills for care you never received or insurance claims you do not recognize.
- Ask your provider whether a claim was submitted in your name if something looks wrong.
- Consider a free credit freeze with Equifax, Experian and TransUnion. The sources do not address this step, but it is standard practice for people worried about identity theft.
What to watch next
Several questions remain open. Paradigm has not named the attacker or the initial access method, and it has not confirmed whether data was definitively taken. It is also unknown whether California or HHS will open an enforcement or audit action, or whether the class-action investigation becomes a filed case.
The next useful signal is whether the 970,000 figure holds once Paradigm finishes confirming who was affected. Watch for a minors notice, any statement from DHCS, and a settled date for the HHS filing. Members who received letters should keep them and review their statements over the coming months, because fraud tied to a benefits record can surface on a bill long after a breach is announced.
