Paradigm Healthcare Services breach exposes data of 970,000 Medi-Cal members; TKD and Ridgeway Pharmacy also report breaches
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on August 18, 2026 that files containing protected health information may have been accessed between October 8 and October 15, 2025. Notification letters are dated September 14, 2026, about 11 months after detection. The article also reports two separate healthcare breaches added to the HHS tracker: law firm Tarter Krinsky & Drogin (TKD) with more than 196,000 affected, and Ridgeway Pharmacy Ltd with more than 258,000 affected.
Technical Details
- Exposed Paradigm data: names, dates of birth, gender and Medi-Cal member identification numbers.
- The notice does not name the threat actor, explain how attackers gained access, or say whether data was exfiltrated. No known cybercrime group appears to have claimed the attack.
- Paradigm's online service documentation and billing platform, Student Health Network (SHN), was reportedly not impacted.
- Paradigm took certain systems offline, notified law enforcement and engaged outside incident response experts.
- TKD: suspicious activity was detected in September 2025, and attackers accessed certain servers between July 9 and September 9, 2025. The investigation concluded a year later.
- Ridgeway Pharmacy: its website was hacked, and attackers may have accessed names, addresses, dates of birth, health and insurance information, prescription information and payment card information. Unauthorized access was discovered on August 21, 2026, and notices began on September 21.
Remediation
The article gives no specific remediation guidance. Paradigm states it has no evidence of fraud or identity theft resulting from the incident.
Linha do tempo
-
Paradigm Healthcare Services breach exposes data of 970,000 Medi-Cal members; TKD and Ridgeway Pharmacy also report breaches
ler a análise desta fonte ocultar
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on August 18, 2026 that files containing protected health information may have been accessed between October 8 and October 15, 2025. Notification letters are dated September 14, 2026, about 11 months after detection. The article also reports two separate healthcare breaches added to the HHS tracker: law firm Tarter Krinsky & Drogin (TKD) with more than 196,000 affected, and Ridgeway Pharmacy Ltd with more than 258,000 affected.
Technical Details
- Exposed Paradigm data: names, dates of birth, gender and Medi-Cal member identification numbers.
- The notice does not name the threat actor, explain how attackers gained access, or say whether data was exfiltrated. No known cybercrime group appears to have claimed the attack.
- Paradigm's online service documentation and billing platform, Student Health Network (SHN), was reportedly not impacted.
- Paradigm took certain systems offline, notified law enforcement and engaged outside incident response experts.
- TKD: suspicious activity was detected in September 2025, and attackers accessed certain servers between July 9 and September 9, 2025. The investigation concluded a year later.
- Ridgeway Pharmacy: its website was hacked, and attackers may have accessed names, addresses, dates of birth, health and insurance information, prescription information and payment card information. Unauthorized access was discovered on August 21, 2026, and notices began on September 21.
Remediation
The article gives no specific remediation guidance. Paradigm states it has no evidence of fraud or identity theft resulting from the incident.