Central Ohio Primary Care Physicians, Inc. (COPC) has confirmed a cybersecurity incident that it says may have exposed the personal and protected health information of about 1.4 million people. According to the organisation's own disclosure, those affected include both patients and employees. The company says it discovered the intrusion on August 25, 2026, and traces it to a voice phishing ("vishing") call. Every source reviewed gives the same figure of roughly 1.4 million affected. COPC describes that number as coming from its "initial investigation" and says "the full extent of the incident is still under review," so the final count could change. One outlet attributes the attack to the Chaos ransomware group, but COPC has not confirmed that, and no other source repeats it.
What Happened
COPC's statement was last updated October 15, 2026, and was also sent to media. It says the company "discovered that it had experienced a cybersecurity incident resulting from a social-engineering, or 'vishing' (voice phishing), attack, carried out in an attempt to solicit a financial response." Through that attack, a criminal threat actor got unauthorised access to "certain files containing protected health information."
After detecting the intrusion, COPC says it brought in outside cybersecurity experts to contain and assess the incident, and it is working with authorities. The company says the incident "has been contained with no further unauthorized access in our systems." It also says its patient portal, MyChart (Epic), was not affected and that patients can keep using it as normal.
Accounts differ on two points:
- Who is affected. COPC's own statement says "patients and employees." Wisevoter describes the 1.4 million as patients only. COPC's wording is the more authoritative of the two.
- Who did it. Wisevoter reports that the ransomware group Chaos is "alleged" to have hacked the physician group and stolen data from patient databases. COPC does not name an attacker and does not mention ransomware or encryption. It describes only a social-engineering intrusion aimed at extracting a financial response. Until COPC or a regulator confirms it, the Chaos attribution should be treated as an unverified claim from a single source.
The timeline from available sources:
- August 2026: intrusion occurs. COPC discovers it on August 25.
- October 15, 2026: COPC updates its public statement. Wisevoter reports that a dedicated patient call center opens the same day, and that notification letters are going out by mail.
For scale, Wisevoter reports that COPC runs about 80 locations across central Ohio. A LinkedIn profile of a COPC compliance employee describes the group as the largest physician-owned primary care group in the United States, with more than 350 physicians. That figure comes from LinkedIn's company summary and should be treated as approximate.
What Was Taken
COPC says the potentially exposed information may include:
- First and last names
- Postal addresses
- Social Security numbers
- Limited health-related patient data, including patient ID numbers
- Financial information
- "Other potential identifying information"
The coverage on cocolasales.com and Wisevoter lists the same categories, and both clearly draw on COPC's statement. No source says that detailed clinical records such as diagnoses, prescriptions, or treatment notes were taken. COPC uses the phrase "limited" health data. Still, SSNs combined with financial data and a confirmed healthcare relationship are enough for identity fraud, medical identity theft, and convincing follow-up phishing.
COPC says it is unaware of any misuse, or attempted misuse, of the data for identity theft or fraud. It is offering complimentary credit and dark web monitoring to affected people.
Why It Matters
This is the second recent central Ohio healthcare breach that started with a phone call. Quantum Health, a healthcare navigation company based in Dublin, Ohio, disclosed earlier in 2026 that an attacker called one of its users on May 29 and talked them into granting network access. The attacker then exfiltrated files containing PHI over about three days. Vuink reports that no group claimed the Quantum Health attack and that the tactics resemble those used by ShinyHunters, which was the subject of a Health-ISAC alert. Nothing in the sources connects the COPC and Quantum Health incidents. The shared pattern is the point: in both cases a phone-based approach to a staff member, not a software exploit, opened the door.
The size of the organisation doesn't limit the size of the breach. A practice group with a few hundred employees exposed records on 1.4 million people. That gap between workforce size and data holdings is what makes regional physician groups attractive targets.
Ohio has been hit from several directions. In the same period, the Supreme Court of Ohio disclosed that Thomson Reuters' C-Track case management platform, used by 10 of the state's 12 appellate courts, was accessed by an unauthorised party between March and June 2026. Sensitive personal data, including medical information, may have been exposed. That incident is unrelated to COPC. Together they mean many Ohio residents may receive more than one breach notice this autumn, which makes it easier for fraudsters to send fake "breach follow-up" messages.
The Attack Technique
COPC confirms the initial access vector was vishing: a social-engineering phone call that led to unauthorised access to files containing PHI. The company says the call was made "in an attempt to solicit a financial response." That phrasing is consistent with an extortion-focused operation. It does not reveal:
- whether the caller impersonated IT support, a vendor, or an executive
- whether credentials, MFA codes, or remote-access tooling were obtained
- how long the attacker was inside before discovery on August 25
- whether any systems were encrypted
The Quantum Health case shows the typical shape of these intrusions. The caller persuades a staff member to grant access, then quickly moves to exfiltrate files over a short window. Whether COPC's intrusion followed the same path has not been disclosed. If the Chaos attribution reported by Wisevoter is accurate, it would point to a double-extortion ransomware operation using phone-based initial access. That remains unconfirmed.
What Organizations Should Do
- Harden help desk identity verification. Require out-of-band callback to a number on file, manager approval, or in-person or video verification before resetting passwords, enrolling MFA devices, or granting remote access. Phone calls alone should never be enough to authenticate someone.
- Use phishing-resistant MFA. FIDO2/WebAuthn or passkeys stop a caller from relaying a one-time code or push approval. Turn on number matching at minimum, and alert on MFA device registrations made outside normal processes.
- Restrict and monitor remote-access tools. Allow only approved RMM and remote-support software, block unapproved installs, and alert when a remote session is followed by large file reads or outbound transfers.
- Find out where your SSNs actually live. Inventory and minimise file shares and exports that hold SSNs and financial data. Restrict access to them, encrypt them, and add data-loss monitoring so bulk access triggers an alert.
- Train staff on vishing specifically. Run phone-based simulations for front-desk, billing, and IT staff, not just email phishing tests. Make it easy and blame-free to hang up and report.
- Prepare for follow-on fraud. Warn patients and employees that attackers may use stolen data to impersonate the organisation by phone or text. Publish the official notification channels so people can check whether contact is genuine.
Sources: Central Ohio Primary Care Physicians Reports Data Breach | US and Canadian court data exposed in Thomson Reuters breach The R... | Cybersecurity Information - Central Ohio Primary Care | Central Ohio Primary Care Data Breach: 1.4 Million Patients' Data a... | Grant Seredick | Statement on Behalf of Supreme Court of Ohio on Cybersecurity Incident | Chapter 5160-1 - Ohio Administrative Code - Ohio Laws | Vishing Attack on Quantum Health Network Exposed Patient Data Vuin...