Paradigm Healthcare Services noticed on October 13, 2025 that someone had entered its local network without permission. The firm processes Medi-Cal billing; Medi-Cal is California's Medicaid program. SecurityWeek reported on October 20 that Paradigm told the US health department more than 970,000 people were affected. Paradigm said the files involved held names, birth dates, gender and Medi-Cal ID numbers.
Paradigm said it worked out which files may have been accessed on August 18, 2026, about 10 months later. That access ran from October 8 to 15, 2025. SecurityWeek said the notice does not name the attacker, say how they got in, or say whether data was taken. The sources do not explain the delay. Paradigm said its Student Health Network platform was not affected.
Analysis, not a finding about Paradigm: spotting an intruder is not the same as knowing which files they touched. The wording may have been accessed shows that gap. Firms holding other people's data need file-level access logs, kept for months, and networks split into zones. Questions for vendors: Do you log each file opened? How long do you keep logs? Can one breach reach our data? How fast will you tell us what was touched?