Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people.
San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf.
The company says it became aware of unauthorized access to its local network on October 13, 2025. “On August 18, 2026, we determined that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025,” Paradigm said.
The compromised files contained names, dates of birth, gender, and Medi-Cal member identification numbers. Paradigm says its online service documentation and billing platform, Student Health Network (SHN), was not impacted.
Paradigm’s notification letters are dated September 14, 2026, roughly 11 months after the intrusion was detected. “We have no evidence that any of your information has been used to commit fraud or identity theft as a result of this incident,” the company said.
The notice doesn’t name the threat actor, explain how the attackers gained access, or say whether data was exfiltrated. Paradigm says it took certain systems offline, notified law enforcement, and brought in outside incident response experts.
No known cybercrime group appears to have taken credit for an attack on Paradigm.
Tarter Krinsky & Drogin and Ridgeway Pharmacy data breaches
The HHS healthcare data breach tracker has been updated to show that a significant number of individuals were affected by separate incidents disclosed recently by the law firm Tarter Krinsky & Drogin (TKD) and Ridgeway Pharmacy Ltd.
TKD, which serves healthcare providers, started notifying individuals in early September that it had detected suspicious activity on its network in September 2025.
The company completed its investigation one year later and determined that attackers accessed certain servers between July 9 and September 9, 2025.
TKD told the HHS that the incident affected more than 196,000 individuals.
Ridgeway Pharmacy, which started sending out data breach notices on September 21, discovered unauthorized access to personal information on August 21, 2026.
The company discovered that its website was hacked and the attacker may have gained access to information such as name, address, date of birth, health and insurance information, prescription information, and payment card information.
Ridgeway Pharmacy informed the HHS that more than 258,000 individuals are affected.
Related: Healthcare data breaches
Related: iRhythm Data Breach Impacts at Least 360,000 People
Related: Oracle Health Data Breach Tally Climbs to Nearly 20 Million
