Paradigm Healthcare Services has told the US Department of Health and Human Services (HHS) that a data breach discovered last year affected more than 970,000 people.
San Francisco-based Paradigm processes billing for Medi-Cal, California’s Medicaid program, under a data use agreement with the California Department of Health Care Services (DHCS). It also maintains Medi-Cal member identification numbers on the department’s behalf.
The company says it became aware of unauthorized access to its local network on October 13, 2025. “On August 18, 2026, we determined that certain files containing select individuals’ protected health information may have been accessed by an unauthorized party between October 8, 2025, and October 15, 2025,” Paradigm said .
The compromised files contained names, dates of birth, gender, and Medi-Cal member identification numbers. Paradigm says its online service documentation and billing platform, Student Health Network (SHN), was not impacted.
Paradigm’s notification letters are dated September 14, 2026, roughly 11 months after the intrusion was detected. “We have no evidence that any of your information has been used to commit fraud or identity theft as a result of this incident,” the company said.
The notice doesn’t name the threat actor, explain how the attackers gained access, or say whether data was exfiltrated. Paradigm says it took certain systems offline, notified law enforcement, and brought in outside incident response experts.
No known cybercrime group appears to have taken credit for an attack on Paradigm.
Tarter Krinsky & Drogin and Ridgeway Pharmacy data breaches
The HHS healthcare data breach tracker has been updated to show that a significant number of individuals were affected by separate incidents disclosed recently by the law firm Tarter Krinsky & Drogin (TKD) and Ridgeway Pharmacy Ltd.
TKD, which serves healthcare providers, started notifying individuals in early September that it had detected suspicious activity on its network in September 2025.
The company completed its investigation one year later and determined that attackers accessed certain servers between July 9 and September 9, 2025.
TKD told the HHS that the incident affected more than 196,000 individuals.
Ridgeway Pharmacy , which started sending out data breach notices on September 21, discovered unauthorized access to personal information on August 21, 2026.
The company discovered that its website was hacked and the attacker may have gained access to information such as name, address, date of birth, health and insurance information, prescription information, and payment card information.
Ridgeway Pharmacy informed the HHS that more than 258,000 individuals are affected.
Related : Healthcare data breaches
Related : iRhythm Data Breach Impacts at Least 360,000 People
Related : Oracle Health Data Breach Tally Climbs to Nearly 20 Million
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
One Compromised Login Exposed Millions of California Students’ Records
MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Anthropic Acquires Confidential AI Startup Opaque Systems
BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts
OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks
Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis
Supermarket Refrigeration Attack Widens to Copeland, Dixell Controllers
AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
The Key to AI Software Security Isn’t Speed, It’s Maturity
Ahold Delhaize Restoring Services Disrupted by Cyberattack
AI Platform Cairn Abused to Hack Over 100 Organizations
Ex-OpenAI Worker Accused of Bugging Conference Room Planned to Fly to Saudi Arabia, Prosecutors Say
Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
Hackers Steal 1.8 Million Records From Nikkei
Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks
Flipboard Whatsapp Whatsapp Email
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
