Central Ohio Primary Care (COPC) says a voice-phishing attack discovered on August 25, 2026 gave a criminal actor access to files with protected health information. The physician group says about 1.4 million patients and employees may be affected.
Central Ohio Primary Care’s Data Breach Investigation
Central Ohio Primary Care Physicians, Inc., known as COPC, is a physician-owned primary care group that treats patients across central Ohio. Like any large medical group, it holds clinical records, billing and insurance details, and personnel files for a sizable workforce. The incident the group disclosed touches both of those worlds, because it involves patients as well as employees.
COPC says it discovered the incident on August 25, 2026. On October 15, 2026, the group publicly acknowledged that a cybersecurity incident may have exposed personal information belonging to roughly 1.4 million current and former patients and employees, or about 1,400,000 people. According to the group’s statement, the incident began with a voice-phishing attack, often called vishing, in which a criminal used a phone-based scam to try to obtain money. Through that scam, COPC says, an unauthorized actor gained access to certain files containing protected health information. COPC has said the scam was not directed at patients, and it has not described who the caller pretended to be.
Several news outlets and plaintiff-side law firms report that a ransomware group known as Chaos has claimed responsibility for the attack. COPC’s October 15 update did not confirm that attribution, so it should be treated as a report rather than a finding. COPC says it brought in cybersecurity professionals, contained the incident, notified law enforcement and is working to strengthen its security. It also says its Epic MyChart patient portal was not affected, and that it is not aware of any misuse of the information for identity theft or fraud so far. The group says its review of the full extent of the incident is still under way.
According to COPC, the files may have included first and last names, addresses, Social Security numbers, financial information, patient ID numbers, limited health-related data and other identifying details. The group notes that not everyone had every type of information exposed. Affected people who have contact information on file are being notified by mail, and COPC is offering complimentary credit monitoring and dark web monitoring. It has also set up a dedicated call center and a website, response.idx.us/copc, where people who did not receive a letter can ask whether they were affected and sign up for the monitoring service.
The timeline matters to anyone affected. The group learned of the incident in late August but did not publicly describe it until mid October, which means people went weeks without knowing their Social Security numbers and other details may have been in the hands of a criminal. A law firm has also reported that a proposed class action was filed on October 16, 2026 in the Franklin County Court of Common Pleas. Those allegations have not been proven, and this page does not take a position on them.
Social Security numbers are especially sensitive because they cannot be changed the way a password can. In combination with an address and financial details, they can be used to open fraudulent accounts, file false tax returns, or build convincing phishing messages. Health-related details and patient ID numbers add the risk of medical identity theft and insurance fraud. This is general context about the types of information COPC described, not a finding about any particular person’s exposure.
Vishing attacks work by persuading a person to hand over access, rather than by breaking through technical defenses. That is why questions about staff verification procedures, access limits on files holding Social Security numbers, and how quickly the group notified patients are the sort of questions attorneys can ask on behalf of people who were harmed. Anyone who receives a notice should compare it with the group’s public statements and keep copies of every letter, email and enrollment confirmation, since those records can matter later if legal claims are pursued.
When Did This Breach Occur?
COPC says it discovered the incident on August 25, 2026, and publicly confirmed the scope on October 15, 2026. The group has not published the exact dates on which the unauthorized actor first gained access.
If you receive a notice, its own dates and description will be the most reliable record of the timeline for your information.
What Information Was Breached?
COPC says the files may have included first and last names, addresses, Social Security numbers, financial information, patient ID numbers and limited health-related data, along with other identifying information. Not every affected person had every type of information exposed.
Your notice letter, if you receive one, is the best source for which details apply to you.
What You Can Do
If you received a notice from COPC or believe you may be affected, consider these steps:
- Read the notice carefully and keep it. Enroll in the complimentary credit monitoring and dark web monitoring COPC is offering, and use response.idx.us/copc to ask whether you were affected if you did not get a letter.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review explanation of benefits statements, bank statements and card statements for anything you do not recognize.
- Be cautious with unexpected calls, texts or emails that mention COPC or your care. If a message claims to be from COPC, do not click links or share personal information; contact your COPC office using a number you already trust.
- Report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Central Ohio Primary Care
If you are notified that your personal or health information was exposed in the COPC incident, you may have legal options. Healthcare organizations are expected to safeguard the sensitive information that patients and employees entrust to them, and a class action can help hold them accountable when they fail to do so.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
