Paradigm Healthcare Services is a San Francisco-based company that processes Medi-Cal billing. It has told the US Department of Health and Human Services (HHS) that an October 2025 intrusion into its local network exposed data on about 970,000 Medi-Cal members (SecurityWeek). Breach tracker ClaimDepot puts the exact figure at 970,403. Paradigm detected the intrusion on October 13, 2025, but did not send notification letters until September 14, 2026. By one law firm's count, that is a 336-day gap. No threat actor has been named, and no known cybercrime group has claimed the attack.
What Happened
Paradigm processes Medi-Cal billing under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department's behalf. Its work is mainly Medicaid claiming for California school districts and educational agencies.
The timeline below is consistent across the company's notice and every source that reproduces it:
- October 8, 2025: Unauthorized access begins.
- October 13, 2025: Paradigm becomes aware of the intrusion while it is still in progress.
- October 15, 2025: Access ends.
- August 18, 2026: Paradigm concludes that files containing protected health information "may have been accessed."
- September 14, 2026: Paradigm files with the California Attorney General and mails notification letters.
Paradigm says it took some systems offline, notified law enforcement and hired outside incident response experts. It says its Student Health Network (SHN) documentation and billing platform was not affected. Downstream customers are now passing the notice on. Centralia Elementary School District, for example, has told families about the Paradigm incident and stressed that its own systems were not breached.
What Was Taken
Paradigm's notice letter, as quoted by SecurityWeek, AcidPeak, Class Action U and Emery Reddy, lists these exposed fields:
- Full name
- Date of birth
- Gender
- Medi-Cal member identification number
ClaimDepot's summary page contradicts the notice in one place: its generic data-type list includes Social Security numbers, addresses and financial information. The primary notice does not list any of these, so the four fields above should be treated as the confirmed scope.
The headcount also varies by source. SecurityWeek, citing the HHS filing, reports more than 970,000 people. ClaimDepot reports 970,403. Cole & Van Note says only "over 500 individuals in California," which looks like the California AG's reporting threshold rather than an actual count. Paradigm's notice says it has no evidence of fraud or identity theft. It also does not say whether the data was exfiltrated or only accessed.
Why It Matters
The delay was not a detection failure. Paradigm spotted the intruder within five days, while the attack was still happening. The time went into scoping the incident. The company needed 309 days to decide that protected health information was involved, and another 27 days to send letters (Emery Reddy's calculation). HIPAA's 60-day notification clock starts at discovery, so this timeline will draw regulatory and legal scrutiny. Cole & Van Note says it has already filed a lawsuit.
The affected population is vulnerable. Many of those affected are likely children enrolled through school-based Medi-Cal programs. A name, date of birth and Medicaid ID together are enough for medical identity fraud. Children's identity theft also tends to go unnoticed for years.
It is another third-party breach. As with the separate ETS incident disclosed to the same school districts, the data was exposed through a vendor rather than through the state agency or the districts themselves.
Note: Paradigm is unrelated to Veradigm, the Chicago-based electronic health record company. The Record reports that Veradigm disclosed a separate vendor-credential breach in September 2026, and the Gentlemen ransomware gang has claimed that attack. The similar names have already caused confusion.
The Attack Technique
The attack technique is unknown. Paradigm's notice does not say how the attackers got in, does not name a threat actor and does not confirm exfiltration. What is known is that the attackers had access to the "local network" for about a week and that Paradigm took systems offline in response. Without more detail, any theory about ransomware, credential abuse or an exploited edge device would be speculation. No leak-site posting has appeared as of publication.
What Organizations Should Do
- Set scoping deadlines in your IR plan. If you cannot tell within weeks which records were accessed, your logging and data mapping are not good enough. Build file-level access auditing for data stores holding protected health information before an incident happens.
- Separate PHI from the general network. Keep member identifier files off flat "local network" shares. Put them in a segmented store with access logging and alerting.
- Write notification timelines into vendor contracts. State agencies and school districts that share Medicaid data should require prompt incident notice and regular scoping updates, not just a final report.
- Notify on a rolling basis. HIPAA allows notification based on what you reasonably believe. Waiting for forensic certainty does not stop the 60-day clock.
- Watch for misuse of Medicaid IDs. Payers and DHCS should flag unusual claims activity on the exposed member IDs, especially minors' IDs.
- Warn affected families. Send guidance on reviewing Explanation of Benefits statements, freezing children's credit, and recognizing phishing that uses the breach as a lure.
Sources: 970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breac... | Electronic health record company says customer data stolen in breac... | NOTICE OF DATA SECURITY INCIDENTS - News and ... | Paradigm Healthcare Services data breach notice, Sep 14, 2026 Acid... | Paradigm Healthcare Breach Affects Medi-Cal Data | Paradigm Healthcare Services Data Breach Lawsuit Emery Reddy | Paradigm Healthcare Services Data Breach Lawsuit - Class Action U | Paradigm Healthcare Services Data Breach Investigation - Cole & Van...