Breaches and incidents
Paradigm Healthcare Services (San Francisco school Medi-Cal billing firm): 970,403 count confirmed for October 2025 breach
Paradigm’s letter dated 14 Sep 2026 (filed with the California AG) says it became aware of unauthorized access to its local network on 13 Oct 2025 and on...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Paradigm’s letter dated 14 Sep 2026 (filed with the California AG) says it became aware of unauthorized access to its local network on 13 Oct 2025 and on 18 Aug 2026 determined PHI “was potentially accessed” between 8 and 15 Oct 2025; data was name, date of birth, gender and Medi-Cal ID. HIPAA Journal reports on 24 Sep 2026 that 970,403 people are now confirmed affected. Update: notification began 14 Sep 2026, one day before the window; the count is new.
- Root cause: not disclosed.
- No attacker named.
- Paradigm took systems offline and notified law enforcement; HIPAA Journal says its billing platform and Student Health Network were not affected.