Paradigm Healthcare Data Breach: 970,000 Medi-Cal Members Exposed — Detection Gaps and HIPAA Breach Notification Lessons

Paradigm Healthcare Services — a vendor that supports school-based Medi-Cal billing for California school districts — has disclosed a data breach affecting approximately 970,000 Medi-Cal members. The intrusion was detected in October 2025, yet notification of affected individuals did not begin until nearly a year later. That gap is the story within the story: an attacker gained access to a system holding sensitive protected health information (PHI) belonging to close to a million low-income Californians, and the victims remained unaware for months.

For defenders, this incident hits three pressure points at once:

1. Third-party/business-associate risk. Paradigm is not a hospital — it's a healthcare services vendor handling PHI on behalf of school districts and the Medi-Cal program. Your HIPAA business associate agreements mean nothing if the associate's detection and escalation pipeline takes eleven months to reach affected individuals.
2. Dwell time and notification latency. Even after detection, the time to scope, contain, investigate, and notify reveals whether an organization has an actual IR capability or just an incident response document. Under HIPAA's Breach Notification Rule, covered entities and business associates must notify individuals without unreasonable delay and no later than 60 days after discovery. A nearly year-long notification window raises serious regulatory exposure questions.
3. Sensitive-population impact. Medi-Cal data typically includes names, dates of birth, addresses, Medi-Cal ID numbers, and potentially Social Security numbers and treatment-related information. This population is disproportionately vulnerable to identity theft, medical fraud, and social engineering.

This post breaks down the defensive lessons: how long-dwell intrusions are actually detected (or missed), what hunt content catches the behaviors typical of this class of breach, and what your IR and vendor-risk programs must do differently.

Technical Analysis

What we know

• Affected entity: Paradigm Healthcare Services, a third-party administrator supporting Medi-Cal billing for California school districts.
• Affected population: ~970,000 Medi-Cal members, including patients associated with school-based health services.
• Timeline: Intrusion detected October 2025; public disclosure and individual notifications began roughly a year later (2026).
• Regulatory context: HIPAA Breach Notification Rule (45 CFR §§ 164.400–414), California's breach notification statute (Cal. Civ. Code § 1798.82), and HHS OCR reporting requirements for breaches affecting 500+ individuals (posted to the OCR breach portal).

No CVE is associated with this incident in the public reporting, and no initial-access vector has been formally attributed. That is typical of vendor breach disclosures — the notification letters describe the data exposed, not the mechanism of compromise. What follows is therefore grounded in the observable pattern class: an external actor gained persistent access to a PHI-bearing system at a healthcare services vendor, and the dwell/response window extended for months.

The likely attack chain (defender's model)

Breaches of this profile — a mid-size healthcare services vendor with web-facing billing/eligibility infrastructure — almost always follow one of a small number of well-understood paths:

1. Initial access via exposed web application or VPN/remote access — unpatched edge appliances, weak MFA on remote access portals, or credential stuffing against vendor portals remain the top vectors against healthcare third parties in 2025–2026.
2. Persistence and privilege escalation — service account abuse, scheduled tasks, or added local accounts on the application/database tier.
3. Discovery and collection — the actor enumerates the database backend (SQL Server/MySQL), stages exports of patient tables, or directly queries the billing system's reporting functions.
4. Exfiltration — bulk data leaves over HTTPS to cloud storage (MEGA, Dropbox, attacker-hosted infrastructure), or via the attacker's C2 channel. Nearly a million records is tens of gigabytes — this is not a stealthy trickle; it is anomalous egress that a functioning monitoring program should see.

The real failure: detection-to-notification latency

The single most important defensive metric in this story is not the initial compromise — it is the timeline. Two distinct clocks matter:

• Dwell time before detection (attacker in → alarm fires). Industry median dwell time in 2025–2026 reporting hovers around 10–11 days for organizations with mature MDR; organizations without 24×7 monitoring routinely run into months.
• Detection-to-notification time (alarm fires → victims told). HIPAA allows a maximum of 60 days from discovery. An ~11-month notification window indicates either a late formal "discovery" determination, a protracted forensic investigation, or organizational/legal delays — none of which a mature IR retainer should produce.

Healthcare breaches reported to HHS OCR in 2024–2025 averaged hundreds of days between incident and notification. That is a sector-wide governance problem, and it is exactly what regulators are now scrutinizing.

Detection & Response

This is a technical threat (network intrusion, data theft, PHI exfiltration), so the following detection content targets the behaviors that define this class of breach: bulk database extraction, staged archive creation, anomalous egress, and persistence on application-tier servers. Every rule is designed to fire on attacker behavior, not routine administration — scope them to your PHI systems and tune exclusions to your environment before production deployment.

Sigma Rules

---
title: Suspicious Archive Creation of Patient Data Directories
id: 4f2c8a91-7b3e-4d5a-9c1f-2e8b6d4a7c19
status: experimental
description: Detects creation of compressed archives targeting directories or database exports associated with patient/PHI data — a common staging step before exfiltration in healthcare breaches.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\7z.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
      - '\7za.exe'
  selection_args:
    CommandLine|contains:
      - 'patient'
      - 'medical'
      - 'medicaid'
      - 'medi-cal'
      - 'phi'
      - 'claims'
      - 'billing'
      - '.bak'
      - '.sql'
      - '.dmp'
  condition: all of selection_*
falsepositives:
  - Legitimate database backup jobs (correlate with scheduled task/service account)
  - Approved data migration projects
level: high
---
title: Bulk Database Export via Command-Line Utility
id: 8a1d5e73-2f6b-4c9d-b3a8-5e7f1c9d2b46
status: experimental
description: Detects use of database command-line export utilities (bcp, sqlcmd, mysqldump) which attackers abuse to extract patient tables en masse from healthcare billing systems.
references:
  - https://attack.mitre.org/techniques/T1213/
  - https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\bcp.exe'
      - '\sqlcmd.exe'
      - '\mysqldump.exe'
      - '\osql.exe'
  filter_backup_accounts:
    User|contains:
      - 'svc_backup'
      - 'svc_veeam'
      - 'svc_commvault'
  condition: selection and not filter_backup_accounts
falsepositives:
  - ETL/reporting jobs run by data engineering — build a named allowlist of job accounts
level: high
---
title: New Local Account Created on Server Hosting Database Services
id: c6e9b2a4-1d8f-4a3c-9e7b-4f2a6c8d1e57
status: experimental
description: Detects creation of local user accounts on servers running SQL Server or MySQL, a common persistence technique after compromising a healthcare application tier.
references:
  - https://attack.mitre.org/techniques/T1136/001/
  - https://www.securityweek.com/970000-medi-cal-members-affected-by-paradigm-healthcare-data-breach/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'net user'
      - 'net1 user'
      - '/add'
  filter_admins:
    User|contains:
      - 'svc_'
      - 'adm_'
  condition: selection and not filter_admins
falsepositives:
  - Provisioning scripts; restrict to database/application servers via asset tagging in your SIEM
level: medium

KQL (Microsoft Sentinel / Defender)

This hunt looks for the exfiltration signature that a ~970,000-record theft cannot hide: abnormally large outbound data volume from PHI-bearing servers to rare external destinations. Baseline your database/application servers and alert on deviation. Pair it with a process query for archive staging.

// Hunt 1: Abnormal egress volume from PHI/database servers to rare destinations
let PHI_Servers = dynamic(["SQLPROD01", "SQLPROD02", "APP-BILLING01"]); // replace with your asset list
let baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(1d))
| where DeviceName in~ (PHI_Servers)
| summarize AvgBytes = avg(tolong(1)) by DeviceName, RemoteIP; // volume fields require custom enrichment
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where DeviceName in~ (PHI_Servers)
| where RemoteIPType == "Public"
| summarize Connections = count(), UniquePorts = dcount(RemotePort), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName
| where Connections > 500 // sustained sessions indicative of bulk transfer
| project DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, Connections, UniquePorts, FirstSeen, LastSeen
| order by Connections desc;

// Hunt 2: Archive/export tool execution on application or database tier
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("7z.exe","rar.exe","winrar.exe","tar.exe","bcp.exe","sqlcmd.exe","mysqldump.exe")
| where ProcessCommandLine has_any ("patient","medical","medicaid","claims","billing",".bak",".sql",".dmp")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc;

// Hunt 3: Rare external destinations for database server traffic (last 7d vs prior 30d)
let KnownDests = toscalar(DeviceNetworkEvents
| where TimeGenerated between (ago(37d) .. ago(7d))
| where DeviceName has_any (PHI_Servers)
| summarize by RemoteIP);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any (PHI_Servers)
| where RemoteIPType == "Public"
| where RemoteIP !in (KnownDests)
| summarize Connections=count(), Processes=make_set(InitiatingProcessFileName) by DeviceName, RemoteIP, RemoteUrl
| order by Connections desc;

Velociraptor VQL

Use this artifact across your Windows application/database fleet to hunt for staged archives and recently executed export tooling — the artifacts left behind when an attacker collects PHI before exfiltration.

-- Hunt for staged data archives and export utility execution on PHI servers
LET archives = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/Desktop/*.zip', 'C:/Users/*/Documents/*.zip',
 'C:/Temp/*.7z', 'C:/Temp/*.zip', 'C:/Temp/*.rar',
 'C:/ProgramData/**/*.7z', 'C:/ProgramData/**/*.rar',
 'C:/Windows/Temp/*.7z', 'C:/Windows/Temp/*.zip'])
WHERE Mtime > now() - 1209600  -- last 14 days (seconds)
  AND Size > 10485760          -- >10MB, sized for bulk record export

LET export_tools = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(7z|rar|winrar|bcp|sqlcmd|mysqldump)\.exe$'

SELECT * FROM archives
UNION ALL
SELECT FullPath='' , Size=0, Mtime=CreateTime, Btime=CreateTime FROM export_tools

Remediation / Hardening Script

This PowerShell script audits a Windows database/application server for the exact indicators relevant to this incident class: recent bulk-archive files, local account additions, and outbound connection history to rare destinations. Run it as part of your compromise assessment if you are a Paradigm client district, and adapt it as a weekly hygiene check on PHI systems.

# Paradigm-class breach hygiene audit: PHI staging, rogue accounts, anomalous egress
# Run elevated on application/database servers. Outputs JSON for SIEM ingestion.

$report = [ordered]@{}

# 1. Large archives created in the last 30 days in suspicious locations
$report['StagedArchives'] = Get-ChildItem -Path 'C:\Temp','C:\Windows\Temp','C:\ProgramData' -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.zip','.7z','.rar' -and $_.Length -gt 10MB -and $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
  Select-Object FullName, Length, LastWriteTime, CreationTime

# 2. Local accounts created in the last 90 days
$report['NewLocalAccounts'] = Get-LocalUser | Where-Object { $_.PasswordLastSet -gt (Get-Date).AddDays(-90) } |
  Select-Object Name, Enabled, LastLogon, PasswordLastSet

# 3. Audit policy check: is process creation logging with command line enabled?
$cmdAudit = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
$report['CmdLineAuditEnabled'] = ($cmdAudit -eq 1)

# 4. Egress: current established connections to public IPs from sqlservr/mysqld
$report['DBEgress'] = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)' } |
  ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Process=$p.ProcessName; PID=$_.OwningProcess; RemoteIP=$_.RemoteAddress; RemotePort=$_.RemotePort } } |
  Where-Object { $_.Process -match 'sqlservr|mysqld|postgres' }

# 5. Enable command-line process auditing if disabled (defensive fix)
if (-not $report['CmdLineAuditEnabled']) {
  New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Force | Out-Null
  Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Value 1
  $report['RemediationApplied'] = 'Enabled ProcessCreationIncludeCmdLine'
  auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable | Out-Null
}

$report | ConvertTo-Json -Depth 5 | Out-File "C:\ProgramData\PHI-hygiene-audit-$(Get-Date -Format 'yyyyMMdd').json"

Remediation

If your organization is a Paradigm client (California school districts and LEAs)

1. Invoke your BAA immediately. Demand the forensic report, the exact data elements exposed per individual, the confirmed access window, and the exfiltration evidence. HIPAA business associates are contractually and statutorily obligated to report breaches to the covered entity without unreasonable delay (max 60 days).
2. Determine your notification obligations. As the covered entity, your district may bear direct notification responsibility under HIPAA and California Civil Code § 1798.82 regardless of the vendor's own notification. Consult counsel now — do not wait on the vendor's timeline.
3. Scope your own exposure. Inventory what data you sent to Paradigm, over what period, and through what integration (SFTP, portal, API). Rotate any credentials, API keys, or certificates used for that integration.
4. Offer credit monitoring and identity protection commensurate with the data elements exposed — if SSNs are involved, California law effectively requires it in practice.

For all healthcare organizations and their vendors

1. Close the detection-to-notification gap. Establish a hard internal SLA: forensic scoping complete within 30 days of confirmed discovery, notification decision within 45, notifications out the door by day 60. Track it as a board-level metric.
2. Baseline and alert on egress from PHI systems. A million-record theft is not subtle. Any database server that begins sustained outbound transfers to destinations outside its 30-day baseline should page the SOC — that single control catches most breach classes.
3. Restrict database export tooling. Remove or ACL bcp.exe, sqlcmd.exe, and equivalent utilities from production application servers. Alert on their execution outside named ETL service accounts (see Sigma rule above).
4. Enforce MFA on every remote access path — VPN, vendor portals, RMM, and cloud consoles. Credential-based initial access remains the dominant vector against healthcare vendors.
5. Segment the PHI tier. Database servers should have no direct internet egress whatsoever; route through an explicit proxy with allowlisting. If your DB server can reach arbitrary public IPs, your exfiltration prevention is aspirational.
6. Vet vendor IR maturity, not just vendor security. In BAA renewals, require: named IR retainer, documented detection-to-notification SLAs, annual tabletop evidence, and 24×7 monitoring attestation. A vendor that takes 11 months to notify is a vendor whose IR program failed.

Regulatory exposure note

Breaches affecting 500+ individuals must be reported to HHS OCR and will appear on the public breach portal. OCR has increasingly imposed civil monetary penalties where notification delay — not just the breach itself — is the violation. The 60-day outer bound is a ceiling, not a target; "without unreasonable delay" is the operative standard. A near-year gap will draw OCR scrutiny and, in California, potential Attorney General enforcement under state breach law.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub