October 15, 2026: Central Ohio Primary Care Physicians (COPC), a physician-owned group with more than 80 practices across central Ohio, confirmed that the personal information of about 1.4 million patients and employees may have been exposed. The intrusion began with a voice-phishing call that led to files containing protected health information. Canonical record: central-ohio-primary-care2026. Local coverage: ABC6.
Voice phishing is attackers calling people and persuading them to share access or information, rather than exploiting software. It is hard to block with technology alone, which is why the lesson for any healthcare group is about staff verification as much as systems.
What happened
- August 25, 2026: COPC found the incident. A criminal had gained access to files containing protected health information after a voice-phishing call.
- Investigation: COPC said the incident was limited to its direct systems. The MyChart patient portal was not affected.
- October 15: COPC confirmed that the personal information of about 1.4 million patients and employees may have been exposed.
- October 16: Notifications began.
Why a phone call can open a file store
Voice phishing relies on a caller who sounds credible, gives a plausible reason for a request, and gets the target to take the next step themselves. It does not need a software flaw. In a practice with many staff and shared systems, one person who believes a caller can open a route that was supposed to stay closed is enough. That is why the response to a breach like this focuses on how staff verify requests as much as on the systems themselves.
What was exposed
According to COPC, the data includes names, addresses, Social Security numbers, financial information and limited patient health information. The exposure covers patients and employees, so people who worked for the group are included as well as people who were treated there. The notices include 709 Massachusetts residents, which shows the group’s patient base reaches beyond Ohio.
COPC says it is not aware of any misuse of the information for identity theft or fraud. That is a statement of what it knows so far, not a guarantee.
Verified vs unverified
- Verified (COPC): the 1.4 million figure; the data categories; the August 25 discovery; the voice-phishing entry route; the limit to direct systems; the MyChart exception; the October 15 confirmation; the October 16 notifications; no known misuse.
- Press reporting only: local reporting says the Chaos ransomware group was behind the attack. COPC has not confirmed that.
- Not known: how the attackers used the voice-phishing call, what fraction of the 1.4 million had Social Security numbers in their records, and whether the data has been published.
How to check whether you were included
COPC’s notices go to the individuals in the affected files. If you are a current or former patient or employee and have not received a letter, do not assume you are outside the data. Call the phone number on a COPC statement you already trust, and ask whether your records were in the affected set. Do not read out your full Social Security number to anyone who calls you first, even if they say they are from COPC.
Who is at risk
Patients and employees whose records were in COPC’s files are the people at risk. Social Security numbers and financial details make identity theft and tax-refund fraud the main concern. Limited health information makes targeted phishing more convincing, because a message can refer to a real appointment or provider.
What to do
- Read the notification letter if you received one, and follow the steps it sets out. Use the phone number or address printed on the letter, not one from an unexpected message.
- Consider a credit freeze with Equifax, Experian and TransUnion. A freeze is free and stops new accounts being opened in your name.
- Check your credit reports and bank statements for accounts or transactions you do not recognise.
- Be wary of calls from anyone claiming to be a doctor’s office, an insurer or COPC that asks you to “verify” your Social Security number or account details. A legitimate provider does not need you to read those numbers out to a caller.
- Check your medical bills and insurance statements for services you did not receive, and ask your insurer about any claims you do not recognise.
- Be cautious with paid services. Some firms have contacted patients offering case evaluations. You do not need to pay anyone to receive or act on a notification from the group.
Context
Health data is valuable because it is hard to change and often ties to insurance and identity. The Moldova health-insurance cyberattack earlier this year shows the same risk for a national system (see our Moldova CNAM post). For COPC, the lesson is the same: a single convincing call can open access to a large set of records.
Sources
- ABC6: Central Ohio Primary Care says cyberattack may have exposed patient, employee data
- Paubox: Central Ohio Primary Care Physicians announces breach impacting 1.4M
Related reading
- Moldova’s CNAM health-insurance cyberattack: another health-data incident with a national scale.