Central Ohio Primary Care Physicians (COPCP), a physician-owned group that provides care to more than 500,000 patients across central Ohio, is reportedly the target of a suspected ransomware attack. Reports describing the incident surfaced on cybersecurity monitoring sites before COPCP itself confirmed any breach publicly, a pattern that is increasingly common as ransomware groups use public disclosure as leverage. Companies entrusted with sensitive patient and employee data have a responsibility to keep that information secure, and to notify the people affected promptly and clearly when it is not.
Central Ohio Primary Care Physicians’ Data Breach Investigation
According to reports, a ransomware group calling itself Chaos claimed responsibility for breaching COPCP’s network on or around August 25, 2026. A cybersecurity monitoring site reported that the group claimed to have obtained approximately 362 gigabytes of data from the healthcare company, though as of this writing COPCP has not publicly confirmed the incident, its scope, or which categories of information may have been involved.
Attorneys are now investigating whether current or former COPCP patients and employees may have grounds to pursue a class action lawsuit over the alleged breach. As is common with healthcare organizations of this size, COPCP’s systems likely store a wide range of sensitive information, including medical records, insurance details, and other identifying data, all of which could be attractive targets for cybercriminals.
Ransomware attacks on healthcare providers have become increasingly common in recent years, in part because medical and insurance records tend to be more valuable on illicit markets than other types of personal data, and because healthcare organizations often cannot afford extended system downtime, which can pressure victims toward paying a ransom. When a ransomware group publishes claims about a supposed victim before that organization has issued its own notification, affected individuals can be left without clear guidance about what information may be at risk or what steps to take to protect themselves.
Under most state and federal data breach notification laws, organizations that confirm a breach involving personal information are required to notify affected individuals within a defined window and to describe, at a minimum, the types of information involved. Until COPCP issues that kind of notice, the exact scope of this reported incident, including whether Social Security numbers, medical records, financial account information, or other sensitive categories were exposed, remains unconfirmed. Individuals who receive a notice, or who are contacted by COPCP about this incident in the future, are encouraged to keep that correspondence, since it can later serve as evidence connecting them to the breach.
When Did This Breach Occur?
Public reporting indicates the suspected attack occurred on or around August 25, 2026, based on a dark web posting attributed to the Chaos ransomware group. COPCP has not published its own timeline confirming when the intrusion began, when it was discovered internally, or when formal notifications to affected individuals, if required, will be sent. This page will be updated if COPCP issues an official notification with more specific dates.
What Information Was Breached?
The specific categories of information involved have not yet been publicly disclosed. Reports describing the incident reference a claimed data volume of approximately 362 gigabytes but do not specify what types of records that data included. Given that COPCP is a healthcare provider, information at risk in an incident like this could plausibly include patient names, dates of birth, Social Security numbers, medical record numbers, treatment or diagnosis information, and insurance details, along with employee records such as payroll or benefits information. None of these categories have been confirmed by the company as of this writing, and this page will be updated if COPCP releases an official notice identifying the data types involved.
What You Can Do
If you are a current or former COPCP patient or employee, there are some general steps you can take while more information becomes available:
Watch your mail and email for any official notification from Central Ohio Primary Care Physicians describing the incident.
Monitor your financial accounts, credit reports, and any insurance or medical billing statements for unfamiliar activity.
Consider placing a fraud alert or credit freeze with the major credit bureaus if you believe your Social Security number may have been exposed.
Be cautious of unsolicited calls, texts, or emails referencing COPCP or claiming to offer help related to the breach, since scammers sometimes exploit news of a breach to run phishing schemes.
File a Data Breach Lawsuit Against Central Ohio Primary Care Physicians
If it is later confirmed that your personal or medical information was exposed as a result of this incident, you may have legal options. Companies that fail to adequately protect the sensitive information entrusted to them can potentially be held accountable through a class action lawsuit, which may allow affected individuals to recover compensation for their losses.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
