970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach

Paradigm Healthcare Services has told the US Department of Health and Human Services that a data breach affected more than 970,000 people. The San Francisco company processes Medi-Cal billing under a data use agreement with the California Department of Health Care Services (DHCS). It became aware of unauthorized access to its local network on October 13, 2025. SecurityWeek's report, by senior managing editor Eduard Kovacs, says that on August 18, 2026 Paradigm determined certain files may have been accessed between October 8, 2025, and October 15, 2025.

This piece covers the fields in those files, the September 14, 2026 notification letters, and what the notice leaves unanswered about the attacker. It is for Medi-Cal members whose identification numbers Paradigm holds for DHCS, and for readers of the HHS healthcare data breach tracker. The same update includes Tarter Krinsky & Drogin and Ridgeway Pharmacy Ltd.

What broke in 970

Paradigm Healthcare Services became aware of unauthorized access to its local network on October 13, 2025. "On August 18, 2026, we determined that certain files containing select individuals' protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025," Paradigm said. The files are part of Medi-Cal billing the San Francisco firm handles for DHCS under a data use agreement, the arrangement under which it keeps member identification numbers for the department.

Paradigm says Student Health Network (SHN), its online service documentation and billing platform, was not impacted. The company took certain systems offline, notified law enforcement, and brought in outside incident response experts. The notice does not name the threat actor, does not explain how the attackers gained access, and does not say whether data was exfiltrated. No known cybercrime group appears to have taken credit for an attack on Paradigm. Letters to affected people are dated September 14, 2026, roughly 11 months after the October 13, 2025 detection.

Who is exposed by 970

Paradigm told the US Department of Health and Human Services that more than 970,000 people were affected. The compromised files contained names, dates of birth, gender, and Medi-Cal member identification numbers. Paradigm maintains those numbers on behalf of the California Department of Health Care Services because it processes billing for Medi-Cal, California's Medicaid program, under the data use agreement. The people in the HHS filing are Medi-Cal members tied to that billing work. Paradigm says Student Health Network was not impacted.

HHS also updated its healthcare data breach tracker for Tarter Krinsky & Drogin (TKD) and Ridgeway Pharmacy Ltd. TKD, a law firm that serves healthcare providers, told HHS that more than 196,000 individuals were affected. Ridgeway informed HHS that more than 258,000 individuals are affected. The pharmacy said its website was hacked and the attacker may have reached name, address, date of birth, health and insurance information, prescription information, and payment card information. Related items name an iRhythm breach of at least 360,000 people and an Oracle Health tally of nearly 20 million.

What to do now about 970

Paradigm's notification letters are dated September 14, 2026, roughly 11 months after detection on October 13, 2025. They follow the August 18, 2026 finding that protected health information may have been accessed from October 8, 2025, to October 15, 2025. "We have no evidence that any of your information has been used to commit fraud or identity theft as a result of this incident," the company said. Paradigm took certain systems offline, notified law enforcement, and brought in outside incident response experts.

Tarter Krinsky & Drogin started notifying individuals in early September. TKD detected suspicious activity on its network in September 2025 and completed its investigation one year later. Attackers accessed certain servers between July 9 and September 9, 2025, and the firm told HHS more than 196,000 individuals were affected. Ridgeway Pharmacy started sending data breach notices on September 21. It discovered unauthorized access on August 21, 2026, including possible exposure of payment card, health, insurance, and prescription information, and it reported more than 258,000 people.

How the 970 issue works

Under a data use agreement with DHCS, San Francisco-based Paradigm processes Medi-Cal billing and maintains member identification numbers for the department. Files on the local network held names, dates of birth, gender, and those identification numbers. Paradigm describes the contents as protected health information for select individuals. The window it gives runs from October 8, 2025, through October 15, 2025. It became aware on October 13, 2025, and on August 18, 2026 determined an unauthorized party may have accessed the files. Student Health Network was not impacted.

TKD and Ridgeway reached the HHS tracker as separate incidents. Tarter Krinsky & Drogin said attackers accessed certain servers between July 9 and September 9, 2025. The firm completed its investigation one year later and reported more than 196,000 individuals. Ridgeway Pharmacy discovered on August 21, 2026 that its website was hacked and that payment card information may have been exposed, then started notices on September 21. It told HHS more than 258,000 individuals are affected. Paradigm's letters dated September 14, 2026 cover the local-network Medi-Cal files.

What is still unknown about 970

Paradigm's notice does not name the threat actor, does not explain how the attackers gained access, and does not say whether data was exfiltrated. No known cybercrime group appears to have taken credit for an attack on Paradigm. On August 18, 2026 the company said certain files containing select individuals' protected health information may have been accessed between October 8, 2025, and October 15, 2025. It said it has no evidence the information has been used to commit fraud or identity theft as a result of this incident.

TKD told HHS that more than 196,000 individuals were affected and that certain servers were accessed from July 9 to September 9, 2025. Ridgeway Pharmacy told HHS that more than 258,000 individuals are affected after the website hack discovered on August 21, 2026. Data that may have been exposed includes payment card information, name, address, date of birth, health and insurance information, and prescription information. iRhythm (at least 360,000 people) and Oracle Health (nearly 20 million) appear as separate related breach items.