A significant data breach at Paradigm Healthcare Services has compromised the personal information of over 970,000 Medi-Cal members. Paradigm, based in San Francisco, processes billing for Medi-Cal under an agreement with the California Department of Health Care Services. The breach was discovered on October 13, 2025, revealing unauthorized access to Paradigm's local network between October 8 and October 15, 2025. The compromised data includes names, dates of birth, gender, and Medi-Cal member identification numbers. Notably, Paradigm's Student Health Network platform was not affected.

Paradigm informed affected individuals with notification letters dated September 14, 2026, nearly a year after the breach was identified. The company stated there is no evidence of fraud or identity theft resulting from the breach. However, details about the threat actor, the method of access, or whether data was exfiltrated remain undisclosed. Paradigm took immediate action by taking certain systems offline, notifying law enforcement, and hiring external incident response experts.

This breach joins others recently disclosed, including incidents involving Tarter Krinsky & Drogin and Ridgeway Pharmacy. Tarter Krinsky & Drogin, a law firm serving healthcare providers, reported a breach affecting over 196,000 individuals after detecting suspicious activity in September 2025. Ridgeway Pharmacy also reported unauthorized access affecting more than 258,000 individuals, where personal and payment information was potentially compromised. These incidents highlight ongoing vulnerabilities in healthcare data security.