Security Guides

#data breach #healthcare #Medicaid #medical identity theft #phishing #United States

Paradigm Healthcare Services Data Breach: Medi-Cal Member IDs and Birth Dates May Have Been Accessed, and What Members Should Do

Medi-Cal billing provider Paradigm Healthcare Services says names, birth dates, gender and Medi-Cal member IDs may have been accessed. What to do.

Published 2026-10-31 Updated 2026-10-31 Last verified 2026-10-31 10 min read

On this page

For: Medi-Cal members in California, especially those who received a letter from Paradigm Healthcare Services, and organizations that hold health program member numbers. This article is based on Paradigm's Notice of Data Breach and its filing with the California Attorney General, and does not cover attack techniques.

Developing: this article will be updated as the organisation publishes more

Who is affected: Medi-Cal members in California, especially those who received a letter from Paradigm Healthcare Services, and organizations that hold health program member numbers.
Confirmed so farSee the table ↓: Period of possible access
Date Paradigm became aware
Listed as possibly affected
Name, date of birth, gender
Medi-Cal member identification number
Not yet confirmed: Number of people affected (official figure)
How the access happened
Whether data was taken, not only accessed
1 more
Whether any misuse occurs later
What to do nowSee the steps ↓: Check whether you received the letter, and use the call center in the notice
Check your benefit statements for services you did not receive
Show your Medi-Cal card only to the people who need it
2 more
Do not trust callers who know your Medi-Cal number and birth date
Consider a fraud alert or credit freeze as a precaution
Where to verify (source)All sources ↓: Paradigm Healthcare Services, "Notice of Data Breach"
Last checked: As of October 31, 2026

Follow-up plans and what we checked

Paradigm's notice does not say whether it will publish follow-up information. As of October 31, 2026, the notice on its website gives no count and no cause. The US Department of Health and Human Services breach portal could not be checked on October 31 (it did not respond).

What Medi-Cal members should do today

Check whether you received the letter, and use the call center in the notice

Paradigm mailed letters dated September 14, 2026. If you are unsure whether you are affected, call the number in Paradigm's notice: 1-833-851-9382, 5:00 am to 5:00 pm Pacific Time, Monday through Friday, excluding holidays. Use the number you find on Paradigm's own notice page, not one given in an unexpected call or message.

Check your benefit statements for services you did not receive

Paradigm's notice recommends reviewing the explanation of benefits statements you receive, following up on any items you do not recognize, and asking for a report of all services paid for you as a beneficiary. A member ID number with a name and birth date is the kind of data that can be used to bill or receive care in someone else's name.

If you see a visit, prescription or equipment you did not receive, contact your health plan or the provider listed. Paradigm also suggests asking for copies of medical records from the date of the possible access to now if needed.

Show your Medi-Cal card only to the people who need it

Paradigm recommends sharing health insurance cards only with your health care providers and the family members who are covered or who help with your care. Be careful with requests to photograph or send your card, especially from someone who contacted you first.

Do not trust callers who know your Medi-Cal number and birth date

Knowing your name, birth date and member ID does not prove a caller works for Medi-Cal, your health plan or Paradigm. If someone asks you to confirm details, renew benefits or pay a fee, hang up and call your health plan or county Medi-Cal office on a number from its official website (how to spot these: What is phishing?).

Consider a fraud alert or credit freeze as a precaution

Paradigm says it has no evidence that the information has been used for fraud or identity theft. As precautions, its notice explains how to place a free one-year fraud alert or a free security freeze with Equifax, Experian and TransUnion, and how to get free credit reports at annualcreditreport.com. Social Security numbers are not among the listed items, so these are options you can choose rather than steps the notice says are required.

What happened (from Paradigm's notice)

The following is based on Paradigm's Notice of Data Breach on its website and the letter it filed with the California Attorney General. Paradigm describes itself as a third-party service provider that processes Medi-Cal billing and maintains Medi-Cal member identification numbers on behalf of DHCS under a data use agreement.

DHCS (Medi-Cal)

Data use agreement with Paradigm

↓→

Paradigm's local network

Unauthorized access; files may have been accessed

↓→

Student Health Network

Billing platform; not impacted (Paradigm)

How the access happened has not been published.

Who holds the data and where the access happened (per Paradigm's notice)

October 8 to 15, 2025
The period in which, according to Paradigm's later finding, files containing protected health information may have been accessed by an unauthorized party.
October 13, 2025
Paradigm becomes aware of unauthorized access to its local network. It takes certain systems offline, notifies law enforcement and engages outside professionals to investigate.
August 18, 2026
Paradigm determines that certain files containing some individuals' protected health information may have been accessed.
September 14, 2026
Date of the letters to individuals. The California Attorney General's list shows Paradigm's filing on this date, with breach dates of October 8 and 15, 2025.

4 items

Name, birth date, gender, Medi-Cal member ID (possible)

About 11 months

From awareness (Oct 13, 2025) to letters (Sep 14, 2026)

About 970,000

People, per press reports (not in the notice)

Not impacted

Student Health Network platform (Paradigm)

What Paradigm's notice says

Organization: Paradigm Healthcare Services, a third-party service provider that processes Medi-Cal billing and maintains Medi-Cal member identification numbers for DHCS under a data use agreement
What happened: Unauthorized access to its local network, which it became aware of on October 13, 2025
Items that may have been accessed: Name, date of birth, gender and Medi-Cal member identification number
Not impacted (Paradigm): Student Health Network, its online service documentation and billing platform
Misuse: Paradigm says it has no evidence that the information has been used to commit fraud or identity theft
Response: Certain systems taken offline, law enforcement notified, outside professionals engaged to investigate
Support offered: Call center 1-833-851-9382. The notice explains fraud alerts, security freezes and free credit reports. It does not mention a credit monitoring offer

What is known and what is not

The state as of October 31, 2026. When Paradigm or a regulator publishes more, the status column will be rewritten.

Item	What the notice says	Status
Period of possible access	October 8 to October 15, 2025	Confirmed (Paradigm)
Date Paradigm became aware	October 13, 2025	Confirmed (Paradigm)
Name, date of birth, gender	May have been accessed	Possible (Paradigm)
Medi-Cal member identification number	May have been accessed	Possible (Paradigm)
Student Health Network	Not impacted	Not included (Paradigm)
Social Security number, bank or card details	Not among the listed items	Not stated
Whether files were taken	The notice says "may have been accessed"	Not stated
Misuse	No evidence of fraud or identity theft	Not confirmed (Paradigm)
Number of people	Not in the notice. Press: about 970,000	Not stated (officially)
Cause and route	Unauthorized access to its local network; details not given	Not stated

How to read this: the count comes from the press, not from the notice

Paradigm's notice does not give a number. SecurityWeek (October 20, 2026) reports that Paradigm told the US Department of Health and Human Services more than 970,000 people were affected, and HIPAA Journal (September 24, 2026) gives 970,403. The two agree, but this site could not check the official HHS listing on October 31, so the figure is shown as a press report.

What this combination of data can lead to

In general, combinations like the following can be misused. This does not mean it has happened here.

Name + date of birth + Medi-Cal member ID: an attempt to receive care or bill services in someone else's name
The same items in a phone call: a convincing "benefits renewal" or "eligibility check" that asks for more details or a payment
The incident itself: fake messages offering "compensation" or "protection" that copy the real notice

For organizations that hold health program member numbers

Paradigm has not published how the access happened, so this section does not judge its security. It covers what the disclosed timeline lets other organizations check.

Plan how long it takes to know what files held. Paradigm became aware of the access in October 2025 and determined which files held health information in August 2026. Keeping an up-to-date map of which servers and folders hold member numbers shortens that step.
Separate member numbers from the systems that do not need them. The notice says the local network was accessed while the billing platform was not impacted. Check whether copies of member numbers sit on internal servers outside the main platform.
Agree with the program owner who notifies whom. Paradigm holds the numbers on behalf of DHCS under a data use agreement. Decide in advance who writes to members and who reports to regulators.

Sources (public records)

The facts in this article are based on the public information below. The count is attributed to the press because the notice does not give one.

Paradigm Healthcare Services, "Notice of Data Breach" — paradigm-healthcare.com
California Attorney General, data breach list entry for Paradigm Healthcare Services (breach dates October 8 and 15, 2025; reported September 14, 2026) and the sample letter dated September 14, 2026 — oag.ca.gov
SecurityWeek, "970,000 Medi-Cal Members Affected by Paradigm Healthcare Data Breach" (October 20, 2026) — securityweek.com
HIPAA Journal, report on the Paradigm Healthcare Services breach (September 24, 2026) — hipaajournal.com
US Federal Trade Commission, "Credit Freezes and Fraud Alerts" — consumer.ftc.gov

Update history

2026-10-31: First version. Based on Paradigm's Notice of Data Breach and its September 14, 2026 filing with the California Attorney General. The count is not in the notice and is shown as reported by SecurityWeek and HIPAA Journal. The article will be updated when Paradigm or a regulator publishes more.

Latest breaking reports

All breaking reports →

FAQ

QWhat may have been exposed in the Paradigm Healthcare Services breach?

According to Paradigm's Notice of Data Breach, the information that may have been accessed included name, date of birth, gender and Medi-Cal member identification number. Paradigm says it determined on August 18, 2026 that files containing some individuals' protected health information may have been accessed between October 8 and October 15, 2025.

QAm I affected, and how many people are?

Paradigm processes Medi-Cal billing for the California Department of Health Care Services, so those affected are members whose information was in the files that may have been accessed (those Paradigm wrote to). Paradigm mailed letters dated September 14, 2026 to the individuals concerned. Its notice gives no count. Press reports put it at about 970,000 people: SecurityWeek says Paradigm told the US Department of Health and Human Services more than 970,000, and HIPAA Journal gives 970,403. If you are unsure, call Paradigm's call center at 1-833-851-9382.

QWere Social Security numbers or bank details exposed?

They are not among the items Paradigm lists. The notice lists only name, date of birth, gender and Medi-Cal member identification number. It does not say other items are excluded, so this article treats them as not stated rather than as not exposed.

QWhat caused it?

Paradigm says it became aware of unauthorized access to its local network on October 13, 2025. How the access happened has not been published. It says its online documentation and billing platform, Student Health Network, was not impacted.

QWhat if someone calls about my Medi-Cal benefits?

A caller who knows your name, birth date and Medi-Cal member ID can sound official. Do not give out more information or pay anything. Hang up and call your health plan or county Medi-Cal office on a number from its official website.

QWhy did the notice come almost a year after the access?

Paradigm says it became aware of the unauthorized access on October 13, 2025, and that its investigation determined on August 18, 2026 that files containing protected health information may have been accessed. Its letters are dated September 14, 2026. The notice does not explain why the investigation took that long.