A California billing contractor sat on a network intrusion for nearly a year before telling the 970,000 Medi-Cal members whose names and member numbers it held.
Paradigm Healthcare Services, which processes Medi-Cal claims for school-based programs under a data use agreement with the California Department of Health Care Services, spotted unauthorized access October 13, 2025. The company only concluded on August 18, 2026 that files with patient health information were likely reached, dating the access window to October 8 through October 15, 2025. Notification letters carry a September 14, 2026 date.
The exposed fields are narrow but durable: names, dates of birth, gender, and Medi-Cal member identification numbers. Paradigm says its billing platform, Student Health Network, was untouched, and that it has no evidence of fraud.
Almost a year of silence
Eleven months between detection and notification is far outside HIPAA's 60-day outer limit, which starts at discovery, not at the end of the investigation. This is the recurring exposure in vendor breaches: the forensic review stretches, and the clock argument shifts to when the organization reasonably should have known.
Paradigm has not named an attacker or said whether data left the network. No cybercrime group has claimed the intrusion.
Member numbers are not harmless
Medi-Cal identifiers key eligibility lookups, provider portals, and pharmacy systems. Paired with a name and date of birth, they support convincing calls to benefits offices, the pretexting currency behind downstream Medicaid fraud.
Members should watch for anyone who quotes their member number back unprompted, and clinics should not treat a caller's member ID as proof of identity for a records request.
Two more disclosures
The HHS tracker also logged law firm Tarter Krinsky & Drogin at more than 196,000 individuals, and Ridgeway Pharmacy at more than 258,000 after its website was compromised in August.
