Central Ohio Primary Care Physicians Data Breach Affects Approximately 1.4 Million People Featured
COPC says an August 2026 voice-phishing attack exposed files containing protected health information belonging to patients and employees.
What Happened in the Central Ohio Primary Care Data Breach?
Central Ohio Primary Care Physicians, Inc. (“COPC”) has disclosed a major cybersecurity incident. COPC is a physician-owned medical group based in Westerville, Ohio.
The company discovered the incident on August 25, 2026. According to COPC, the attack involved a form of social engineering known as “vishing,” or voice phishing. A criminal threat actor reportedly used the attack to gain unauthorized access to files containing protected health information. It is alleged that approximately 362 gigabytes of sensitive information was exfiltrated by the hackers.
After discovering the incident, COPC says it hired cybersecurity and legal experts to investigate. The company also took steps to contain the attack.
COPC has stated that the incident is now contained. In addition, the company says its MyChart patient portal was not affected.
COPC estimates that approximately 1.4 million patients and employees may have been impacted.
What Information May Have Been Exposed?
The information involved may differ from person to person. According to COPC, potentially affected information may include:
- First and last names
- Addresses
- Dates of birth
- Social Security numbers
- Patient identification numbers
- Financial information
- Health insurance information
- Medical records and treatment information
- Limited health-related information
- Other identifying information
Reports have also linked the attack to a ransomware group known as Chaos.
COPC has not publicly confirmed the Chaos attribution or the reported amount of data taken.
A CLASS ACTION HAS BEEN FILED
A proposed class action has been filed following the Central Ohio Primary Care Physicians data breach.
The lawsuit seeks relief on behalf of people whose private information was allegedly compromised during the August 2026 incident.
Filing a class action does not mean COPC has been found liable. The allegations and claims must still be proven in court.
What Can Affected Individuals Do?
COPC says it is offering complimentary credit monitoring and dark web monitoring services to potentially affected individuals.
If you receive a data breach notice, keep the letter for your records. You should also review the instructions for enrolling in any monitoring services being offered.
In addition, affected individuals may want to review their credit reports and financial accounts for suspicious activity.
You may also consider placing a fraud alert or credit freeze with the major credit bureaus. Be especially cautious about unexpected emails, telephone calls, or text messages asking for personal information.
COPC stated in an October update that it was not aware of misuse or attempted misuse of personal information for identity theft or fraud related to the incident.
Were You Affected by the COPC Data Breach?
If you received a data breach notice from Central Ohio Primary Care Physicians, or believe your information may have been involved, you may have legal rights.
Complete the confidential form on this page to learn more about the investigation and whether you may qualify to participate in the class action.