Roughly 1.4 million people had their names, Social Security numbers and health details exposed in the Central Ohio Primary Care data breach, which the group disclosed on October 15. Central Ohio Primary Care is one of the largest physician-owned primary care groups in the United States, with more than 80 practice locations serving over 500,000 patients across central Ohio. Notices are now going out by mail, and the group says the intrusion has been contained.
What the Central Ohio Primary Care data breach involved
NBC4 reported that the group confirmed the 1.4 million figure, and 10TV described the count as “around” 1.4 million people. The figure counts people affected. The group has not said how many records were taken in total, or how many of those people are current patients, former patients or employees.
COPC says it discovered the incident on August 25, 2026. In COPC’s account, as reported by ABC6, a social-engineering phone scam aimed at soliciting a financial response allowed a criminal threat actor to reach certain files containing protected health information. The disclosure came 51 days after discovery, and the reporting available for this story does not explain that gap.
COPC said MyChart, the Epic patient portal, was not impacted, and patients can keep using it to connect with their providers. The group also said, “This incident has been contained with no further unauthorized access in our systems.”
How a phone scam got into patient and employee files
Phone-based social engineering sits at the center of this breach, and COPC has not explained the phone path in detail. That leaves a basic question open: how did the caller get past staff controls? Nothing in the statements available for this story describes which verification steps were in place or which were skipped.
Vishing, or voice phishing, is not new, but it is a repeat tactic in 2026. Medical device maker iRhythm disclosed a breach affecting at least 360,000 people. SecurityWeek and The Record both reported that the intrusion also began with social engineering on third-party-hosted business apps, with an access window running from June 3 to June 8.
Attackers often do not need a technical exploit when they can persuade a person to grant access or move data. A large practice group holds records for hundreds of thousands of people, so one successful call can reach a lot of data at once.
Which data was exposed and who is affected
COPC says the information potentially exposed may include:
- First and last names
- Home addresses
- Social Security numbers
- Financial information
- Limited health data, including patient ID numbers
- Other potentially identifying information
Patients and employees across central Ohio, including people in Westerville, are the most directly affected. Anyone in the data set could face phishing, tax fraud or account fraud. Social Security numbers combined with addresses and health details rank among the highest-risk combinations in identity theft, because they let criminals pose convincingly as the victim to banks, lenders and other institutions.
COPC says it is not aware of any misuse of personal information for identity theft or fraud, and the investigation is ongoing. That statement could change as the investigation moves forward.
The ransomware question is still open. NBC4 reported, citing unnamed sources, that a ransomware group called “Chaos” hacked COPC and stole personal information. COPC’s public statements do not name a group, and no law enforcement agency has confirmed the claim, so treat the attribution as single-source reporting.
Don Deep, the group’s chief executive, told NBC4, “We take this matter seriously.” That single line is the only leadership comment in the sources available for this story, and it offers no detail on the phone scam.
Did you get a letter? How to check and enroll
Affected people will receive a written notification by mail. COPC is offering complimentary credit and dark web monitoring to anyone whose information may have been exposed. If you believe you were affected but did not receive a letter, the group directs you to a dedicated enrollment site at https://response.idx.us/copc.
Scammers often copy breach notices, so compare the web address in any letter with the official one above before you enter personal information. If a letter or call pushes you to act fast, slow down and verify it first. The sources available for this story do not list an enrollment deadline, so read your letter closely for one.
Steps to take if your information may have been exposed
- Enroll in the offered credit and dark web monitoring as soon as you receive your letter, or through the enrollment site if you do not get one.
- Place a fraud alert or security freeze with each of the three credit bureaus, Equifax, Experian and TransUnion. Both options are free under federal law, and a freeze blocks new credit checks until you lift it.
- Review medical bills and insurance explanation-of-benefits statements for services you did not receive, and call your provider or insurer about anything that looks wrong.
- Hang up on unsolicited calls that ask for money or personal details, even if the caller says they are from your doctor’s office. Call back using a number you already have rather than one the caller gives you.
Why vishing keeps working against healthcare groups
The FBI and Secret Service have also warned about a separate wave of attacks on network infrastructure. Their advisory covers FortiBleed, a Fortinet credential campaign. The FBI says that in some incidents, the threat actor creates administrator accounts and uses their privileges to delete existing admin accounts or change their passwords, which denies victims access to their devices. BleepingComputer has the details. That campaign is separate from the COPC case, and the sources here do not establish a link between them.
The practical lesson for healthcare groups is to treat any unexpected request for money, passwords or account changes as a verification step, not a judgment call for one employee. Staff need a callback procedure and a clear path for escalating suspicious requests.
For more on how these attacks are packaged, USA 24 has covered phishing infrastructure, including the Microsoft and Health-ISAC takedown of domains behind YAM Store phishing kits. Our coverage of CenterPoint’s breach, which exposed personal data of over 1 million Texans, shows what a large personal data exposure looks like in practice.
What to watch next
- COPC’s fuller account of the attack, including how the caller got past staff controls.
- Whether the 1.4 million figure changes once the group counts records and separates current patients from former patients and employees.
- Whether COPC or law enforcement confirms or rejects the Chaos attribution.
- State breach filings and any regulatory response. The reporting available for this story mentions neither yet and does not describe a lawsuit.
The mailed notices will likely answer more than any press statement. If they include an enrollment deadline, a clearer description of the phone scam and a count of the records taken, many open questions will close. Until then, the sensible assumption for anyone who may be in the data set is that the exposed details could be used against them, and that any unexpected call asking for information deserves a callback to a known number.
