Paradigm Healthcare Services has told the US Department of Health and Human Services that 970,000 people were caught in an intrusion it detected in October 2025. The San Francisco company processes billing for Medi-Cal, California’s Medicaid program, and holds member identification numbers for the state health department.
Victim letters carry a September 14, 2026 postmark. That lands about eleven months after staff first noticed someone inside the local network.
What the record shows
According to Paradigm, the company established on August 18, 2026 that files holding protected health information might have been read during October 8 to October 15, 2025. Names, birth dates, gender and Medi-Cal member identification numbers sat in those files.
Its Student Health Network billing platform came through untouched. The notice names no attacker, offers no entry point and does not say whether records left the network. No cybercrime group has claimed the job. Paradigm describes taking some systems dark, alerting police and hiring outside responders, though it saw no sign the data had been used for fraud or identity theft.
The delay is the story
Ten months separate the confirmed data access from the mailed letters, and regulators increasingly score that gap as a separate failure from the breach itself. For security leaders, forensic scoping should be a deliverable with a calendar date attached rather than an investigation that runs until it runs out.
Two more HHS entries
Tarter Krinsky & Drogin, a law firm serving providers, reported more than 196,000 individuals; attackers sat in certain servers from July to September 2025 and the review closed a year on. Ridgeway Pharmacy logged 258,000 after learning its hacked website may have spilled names, prescriptions and card details.
Dwell time links all three. Speeding up detection is the only lever that shortens a notification clock.
