Eleven Months From Intrusion to Letters: The California Medicaid Billing Breach Touching 970,000 People, by the Numbers
Paradigm Healthcare Services, which processes Medi-Cal billing for California, has reported a breach affecting more than 970,000 people. The intrusion was spotted in October 2025, but letters went out nearly a year later. Here is the incident in numbers, and the lesson for any business that holds data for someone else.
When a state agency hands data to a contractor, the people in that data rarely know the contractor exists. More than 970,000 Californians enrolled in Medi-Cal, the state’s Medicaid program, are learning the name Paradigm Healthcare Services this way.
The figures below come from SecurityWeek’s report, which drew on Paradigm’s filing with the U.S. Department of Health and Human Services, and from the notice Paradigm posted on its website.
The incident in numbers
970,403
People affected, according to the federal breach tracker. Paradigm is a San Francisco-based third-party provider that processes Medi-Cal billing and maintains member ID numbers under a data use agreement with the California Department of Health Care Services.
8 days
The window of unauthorized access Paradigm identified, from October 8 to October 15, 2025. The company says it became aware of the intrusion on its local network on October 13, 2025.
4 data points
Name, date of birth, gender and Medi-Cal member identification number are what Paradigm says may have been accessed. Its online documentation and billing platform, Student Health Network, was not affected.
About 10 months
Time from detection to the finding that mattered: on August 18, 2026, Paradigm concluded that certain files containing individuals’ protected health information may have been accessed.
About 11 months
Time from detection to notification. SecurityWeek reports the letters are dated September 14, 2026.
0
Known cybercrime groups that have claimed the attack, per SecurityWeek. Paradigm’s notice also does not name an attacker, explain how they got in, or say whether data was taken out of the network. The company says it took some systems offline, notified law enforcement and hired outside incident response specialists, and that it has no evidence the information has been used for fraud or identity theft.
If a letter arrives at your home
- Paradigm lists a call center for questions at 1-833-851-9382, weekdays from 5 a.m. to 5 p.m. Pacific.
- Review the explanation-of-benefits statements from your health plan and question any service you do not recognize, a basic guard against medical identity theft that Paradigm’s notice also recommends.
- Consider a free fraud alert or security freeze with the credit bureaus, as the notice suggests.
- Share health insurance cards only with your providers and the family members who help with your care.
The same week, two more
SecurityWeek’s report also notes that the HHS tracker now shows more than 196,000 people affected by a breach at law firm Tarter Krinsky & Drogin, which serves healthcare providers, and more than 258,000 affected by a website hack at Ridgeway Pharmacy.
What this means for your company
Two lessons apply far beyond healthcare. First, if you process data on behalf of a client or agency, you are the one who has to detect, investigate and notify, and your contract likely sets deadlines. Logging and an incident response retainer arranged in advance shorten that clock. Second, if you hand data to vendors, ask them how quickly they would detect and report a breach, and put the answer in writing. A billing vendor’s local network turned out to be the weak spot here, not the state’s systems.
Need help preparing your incident response plan or reviewing how your vendors protect the data you share with them? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
