Paradigm Healthcare Services confirmed a data breach affecting more than 970,000 Medi-Cal members after discovering unauthorized network access that occurred in October 2025. Exposed data included names, dates of birth, gender, and Medi-Cal member ID numbers. Affected individuals should monitor their credit reports and watch for signs of medical or insurance fraud right away.
| Company | Paradigm Healthcare Services |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names, Dates of Birth, Gender, Medi-Cal Member Identification Numbers |
| People Affected | 970,000 individuals |
| Attack Method | Unauthorized Network Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Paradigm Healthcare Services Data Breach?
Paradigm Healthcare Services has confirmed a data breach that exposed personal information belonging to hundreds of thousands of Medi-Cal members. The San Francisco-based company processes billing for Medi-Cal, California’s Medicaid program, under an agreement with the state’s Department of Health Care Services. As a result, Paradigm holds sensitive member records on the department’s behalf.
According to the company, unauthorized access to its internal network first occurred between October 8 and October 15, 2025. However, Paradigm says it did not determine that files had actually been accessed until August 2026. This gap between intrusion and discovery meant the exposed information sat unprotected for nearly a year before anyone realized what had happened.
Paradigm has not named the attacker responsible, nor has it explained exactly how the intruder got into its systems. The notice also does not confirm whether the stolen files were copied or removed from the network. In response to the incident, Paradigm says it took affected systems offline, alerted law enforcement, and brought in outside forensic specialists to investigate further.
No cybercrime group has publicly taken credit for the Paradigm Healthcare Services data breach. This differs from many healthcare breaches, where extortion groups often announce their involvement on leak sites. The lack of a public claim means important details about the attack may remain unknown for some time.
Who was affected?
Paradigm says the breach affected more than 970,000 individuals. Because the company processes billing and maintains identification numbers for Medi-Cal, the people affected are primarily Medicaid beneficiaries in California rather than Paradigm’s own employees.
This means the breach could touch a wide range of people, including children, seniors, and other vulnerable groups who rely on Medi-Cal for healthcare coverage. Because Medicaid serves low-income residents, affected individuals may have fewer financial resources to absorb the costs of identity theft recovery. In addition, the involvement of a state health program means the breach has drawn attention from California regulators overseeing healthcare privacy.
What Information Was Potentially Exposed?
Paradigm has stated that specific categories of personal information were contained in the affected files. The company’s notice describes a limited but still sensitive set of data elements tied to each member’s identity and healthcare enrollment.
- Full names
- Dates of birth
- Gender
- Medi-Cal member identification numbers
Although this list does not include Social Security numbers or financial account details, the combination of a name, birth date, and government-issued member ID number still carries real risk. Criminals can use these details to attempt healthcare fraud, such as submitting false claims or obtaining medical services under someone else’s identity.
Furthermore, this type of information can be combined with data from other breaches to build a more complete profile of a victim. As a result, affected individuals could face an increased risk of targeted phishing attempts or social engineering schemes that reference their real personal details to appear legitimate.
What is the company doing?
Paradigm says it responded to the incident by taking certain systems offline and notifying law enforcement right away. The company also engaged outside incident response experts to help determine the scope of the intrusion and confirm what data was involved.
Paradigm has stated that it has no evidence the exposed information has been used to commit fraud or identity theft. Notification letters to affected individuals are dated September 2026, roughly eleven months after the intrusion was first detected. In addition, Paradigm filed a formal breach report with the HHS Office for Civil Rights, as required for breaches involving protected health information.
The company has not disclosed whether it is offering credit monitoring or identity protection services to those affected. Individuals who received a notice should review it closely, since it may contain instructions specific to their situation that are not reflected in public reporting.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Anyone who received a notice from Paradigm should check their credit reports regularly over the coming months. Because member ID numbers and personal details were involved, unusual account activity could show up in ways that aren’t immediately obvious.
You can request a free credit report from each of the three major bureaus through AnnualCreditReport.com. Reviewing these reports every few months makes it easier to catch new accounts or inquiries you don’t recognize before they cause lasting damage.
Watch for Signs of Medical or Insurance Fraud
Since this breach involved Medi-Cal identification numbers, affected individuals should watch closely for signs of medical identity theft. This can include unfamiliar medical bills, insurance claims for services you never received, or letters about coverage changes you didn’t request.
If you notice anything suspicious, contact Medi-Cal or your healthcare provider immediately to flag the activity. Acting quickly can help prevent fraudulent claims from affecting your actual medical records or insurance coverage going forward.
Stay Alert for Phishing and Scam Attempts
Because names and dates of birth were exposed, scammers may use this information to craft convincing phishing emails, calls, or texts. These messages often pretend to be from a healthcare provider, insurer, or government agency to seem trustworthy.
Never click links or share additional personal details in response to unsolicited messages, even if they reference accurate information about you. Instead, contact the organization directly using a verified phone number or website to confirm whether the request is legitimate.
Consider a Fraud Alert if You Notice Other Red Flags
While this breach did not expose Social Security numbers, a fraud alert can still add an extra layer of protection if you’re concerned about identity theft. A fraud alert requires lenders to take extra steps to verify your identity before approving new credit in your name.
You can place a free fraud alert by contacting any one of the three major credit bureaus, since they are required to notify the other two. This step is especially useful if you notice any unusual activity tied to your identity after receiving a breach notice.
Keep Records and Consult a Data Breach Attorney
It’s a good idea to keep a copy of your notification letter along with any records of suspicious activity you discover afterward. This documentation can be valuable if you later decide to pursue a claim related to the breach.
Many affected individuals choose to speak with a data breach attorney for a free case evaluation. An attorney can help you understand your legal options and whether you may be eligible for compensation tied to this incident.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.