Paradigm Healthcare Services breach: Medi-Cal member ID numbers accessed in October 2025

Was the Student Health Network platform hacked?

No, according to Paradigm. Its website notice says the online service documentation and billing platform, Student Health Network (SHN), was not affected; the access was to Paradigm's local network. On detecting the activity it took some systems offline and notified law enforcement.

SecurityWeek reported on October 20, 2026 that the notice does not name the attacker, explain how it got in, or say whether data was taken out, and that no known cybercrime group appeared to have claimed the attack.

What happened in the Paradigm Healthcare Services breach?

Paradigm says it processes Medi-Cal billing and keeps Medi-Cal member identification numbers under a data use agreement with the Department of Health Care Services (DHCS). It became aware of unauthorized access to its local network on October 13, 2025, took systems offline, notified law enforcement and brought in investigators.

Date	What the letter and the regulators' records say
October 8, 2025	Possible access begins; first breach date on California's record
October 13, 2025	Paradigm becomes aware of the access
October 15, 2025	Possible access ends
August 18, 2026	Paradigm determines that members' information was potentially accessed
September 14, 2026	Date printed on the letter; report submitted to HHS; notice recorded by California

336 days passed between Paradigm becoming aware of the access and the letters, and 27 days between its finding about members' data and the letters. The notice delay study puts gaps like these in context.

What information was involved?

Names, dates of birth, gender and Medi-Cal member identification numbers. The letter does not mention Social Security numbers, financial information or medical records.

How many people were affected?

The federal health breach list records 970,403 individuals, the 16th largest 2026 report among its open cases. None of the Texas, Washington, Massachusetts or Indiana lists fetched for this page carries a matching Paradigm Healthcare Services report.

What is Paradigm offering people who got a letter?

The filed letter describes steps people can take themselves (fraud alerts, security freezes and free credit reports) and does not offer a monitoring service. The call center number is a blank field in the filed copy; the website notice gives it as 1-833-851-9382, 5:00 am to 5:00 pm Pacific Time, Monday to Friday, excluding holidays. The credit monitoring offers guide shows what other notices offer.

How can Medi-Cal members protect their medical identity after the Paradigm breach?

Paradigm's website notice lists practices that it says can help protect against medical identity theft.

Step	What the notice says to do
Guard the card	Share the health insurance card only with providers and family members on the plan or who help with care
Read the benefit statements	Check each explanation of benefits and follow up on any service you do not recognize
Ask for the records	If needed, ask the provider for records from the date of the possible access onward
Ask for a services report	Ask the insurer for a year-to-date report of all services paid for you

Why did I get a letter from Paradigm Healthcare Services?

You are, or were, a Medi-Cal member, and Paradigm handles Medi-Cal billing data for the state. The guide to letters from companies you never dealt with explains vendor breaches, and the government breach guide covers public-sector notices.

What the documents leave open

• How the unauthorized party got into the local network.
• Why the finding about members' data took until August 18, 2026.
• Whether DHCS itself will notify members separately.
• Whether the files were copied out of the network or only viewed; the notice says "may have been accessed".