Two more vendors in the healthcare supply chain have come forward with intrusions, one at a platform that bills for student health services and one at a maker of medical devices.
The first came from Paradigm Healthcare Services, which handles Medi-Cal billing for school districts out of San Francisco. Its staff found an intruder inside the local network on October 13, 2025, and the activity was later dated to a week-long stretch that closed on October 15, 2025. Nothing touched the wider program: the Student Health Network kept running, and so did the separate online platform that holds service documentation and billing records. Names, dates of birth and gender information were among the fields exposed. The state program’s member numbers rounded out the list.
The second involves LeMaitre Vascular, a Burlington company whose products treat peripheral vascular disease, and a network intrusion that Massachusetts regulators logged. An unauthorized party may have viewed or taken sensitive records, and the categories involved run across identity, immigration and financial data, with clinical records pulled in as well. Almost 1,000 Massachusetts residents are known to be affected; the company has released no national total.
Both disclosures sit on the fault line that has defined the year, vendors who hold patient data. One carried student health identifiers; the other mixed immigration and financial records with clinical ones. Neither company calls its count final.
