Central Ohio Primary Care Confirms Data Breach Affecting 1.4 Million People
A phone scam compromised sensitive health and personal files, prompting patient notifications and complimentary credit monitoring.
Central Ohio Primary Care Physicians, Inc. said a cybersecurity incident tied to a "vishing" attack may have exposed personal information belonging to patients and employees, with the organization's initial investigation indicating about 1.4 million individuals could be affected. The medical provider confirmed to NBC4 that 1.4 million people were impacted in the breach.
Phone Scam Triggered Network Intrusion
COPC said it discovered the incident Aug. 25, 2026, after a social-engineering phone scam aimed at soliciting a financial response allowed a criminal threat actor to gain unauthorized access to certain files containing protected health information.
According to an August 26, 2026 post on dark web security blog HookPhish, ransomware group Chaos was behind the suspected attack, which was estimated to have occurred the previous day. In an incident summary, DeXpose reported, "The group has threatened to leak sensitive data unless negotiations are initiated by the organization." Cybersecurity site Breachsense separately reported that Chaos claimed to be responsible for an attack on COPCP that resulted in the acquisition of 362 gigabytes of data from the healthcare company.
Potentially Compromised Files and Portal Status
COPC stated that the information potentially exposed may have included protected health information, including sensitive personal information such as first and last name, address, Social Security number, limited health-related patient data including patient ID number, financial information, and other identifying information.
COPC said the incident has been contained with no further unauthorized access in its systems, and MyChart (Epic) was not impacted and patients can continue using the portal to connect with their providers. In its cybersecurity advisory to patients, COPC stated, "Please know our practices remain open and are operating as normal."
"We take this matter seriously and are implementing enhanced security protocols to further protect our systems, our team members and everyone who trusts us with their personal information," Don Deep, MD, CEO at COPC, said.
Regulatory Reporting and Notification Deadlines
The organization said its internal teams are continuing to work with third-party experts and follow best practices and federal and state regulations intended to protect those affected.
Under federal HIPAA breach reporting guidelines, for breaches affecting 500 or more individuals, you must report to HHS OCR without unreasonable delay and no later than 60 calendar days after the breach discovery date. Covered entities must also notify affected individuals without unreasonable delay and no later than 60 calendar days after the breach discovery date. The Oct. 15, 2026 public announcement occurred 51 days after COPC discovered the breach on Aug. 25, falling within that 60-day federal window.
Patient Guidance and Identity Protections
COPC said it is not aware of any misuse or attempted misuse of personal information for identity theft or fraud stemming from the incident. The medical provider is offering complimentary credit and dark web monitoring through the IDX Identity Theft Protection Plan.
COPC said impacted individuals with contact information on file will receive written notification, while those who believe they may be impacted but do not receive a letter can visit https://response.idx.us/copc for more information, to request confirmation of impact, and to request a credit monitoring sign-up code. COPC said the letter and website include steps to safeguard information, including instructions for signing up for IDX credit monitoring and placing security freezes on credit profiles.
COPC also said it has established a dedicated call center to address concerns and provide additional support.
How we know this
The sources and records behind this story, with the facts they support.
Supporting evidence (11)
Central Ohio Primary Care Physicians, Inc. said a cybersecurity incident tied to a "vishing" attack may have exposed personal information belonging to patients and employees, with the organization's initial investigation indicating about 1.4 million individuals could be affected.
Read supporting passage
Central Ohio Primary Care Physicians, Inc. says a cybersecurity incident tied to a “vishing” attack may have exposed personal information belonging to patients and employees, with the organization’s initial investigation indicating about 1.4 million individuals could be affected.
COPC said it discovered the incident Aug. 25, 2026, after a social-engineering phone scam aimed at soliciting a financial response allowed a criminal threat actor to gain unauthorized access to certain files containing protected health information.
COPC stated that the information potentially exposed may have included protected health information, including sensitive personal information such as first and last name, address, Social Security number, limited health-related patient data including patient ID number, financial information, and other identifying information.
Read supporting passage
The information potentially exposed may have included protected health information, including sensitive personal information such as first and last name, address, Social Security number, limited health-related patient data including patient ID number, financial information, and other identifying information.
COPC said the incident has been contained with no further unauthorized access in its systems, and MyChart (Epic) was not impacted and patients can continue using the portal to connect with their providers.
Read supporting passage
“This incident has been contained with no further unauthorized access in our systems,” COPC said. The organization also said MyChart (Epic) was not impacted and patients can continue using the portal to connect with their providers.
"We take this matter seriously and are implementing enhanced security protocols to further protect our systems, our team members and everyone who trusts us with their personal information," Don Deep, MD, CEO at COPC, said.
Read supporting passage
“We take this matter seriously and are implementing enhanced security protocols to further protect our systems, our team members and everyone who trusts us with their personal information,” Don Deep, MD, CEO at COPC, said.
The organization said its internal teams are continuing to work with third-party experts and follow best practices and federal and state regulations intended to protect those affected.
COPC said it is not aware of any misuse or attempted misuse of personal information for identity theft or fraud stemming from the incident.
The medical provider is offering complimentary credit and dark web monitoring through the IDX Identity Theft Protection Plan.
Read supporting passage
COPC said it is offering complimentary credit and dark web monitoring through the IDX Identity Theft Protection Plan.
COPC said impacted individuals with contact information on file will receive written notification, while those who believe they may be impacted but do not receive a letter can visit https://response.idx.us/copc for more information, to request confirmation of impact, and to request a credit monitoring sign-up code.
Read supporting passage
COPC said impacted individuals with contact information on file will receive written notification. Those who believe they may be impacted but do not receive a letter can visit https://response.idx.us/copc for more information, to request confirmation of impact, and to request a credit monitoring sign-up code.
COPC said the letter and website include steps to safeguard information, including instructions for signing up for IDX credit monitoring and placing security freezes on credit profiles.
COPC also said it has established a dedicated call center to address concerns and provide additional support.
1.4 million impacted by Central Ohio Primary Care Physicians data breach
Supporting evidence (1)
The medical provider confirmed to NBC4 that 1.4 million people were impacted in the breach.
Read supporting passage
COPC has confirmed to NBC4 that 1.4 million people were impacted in this breach.
https://www.classaction.org/data-breach-lawsuits/central-ohio-primary-care-physicians-august-2026
Supporting evidence (2)
According to an August 26, 2026 post on dark web security blog HookPhish, ransomware group Chaos was behind the suspected attack, which was estimated to have occurred the previous day.
Cybersecurity site Breachsense separately reported that Chaos claimed to be responsible for an attack on COPCP that resulted in the acquisition of 362 gigabytes of data from the healthcare company.
Read supporting passage
Breachsense, another cybersecurity site, similarly reported that Chaos claimed to be responsible for an attack on COPCP that resulted in the acquisition of 362 gigabytes of data from the healthcare company.
https://www.dexpose.io/chaos-ransomware-targets-central-ohio-primary-care/
Supporting evidence (1)
In an incident summary, DeXpose reported, "The group has threatened to leak sensitive data unless negotiations are initiated by the organization."
Read supporting passage
The group has threatened to leak sensitive data unless negotiations are initiated by the organization.
https://www.copcp.com/company-news/copc-cybersecurity-information/
Supporting evidence (1)
In its cybersecurity advisory to patients, COPC stated, "Please know our practices remain open and are operating as normal."
Read supporting passage
Please know our practices remain open and are operating as normal. We will update this statement as our investigation progresses.
https://www.accountablehq.com/post/hipaa-breach-reporting-to-hhs-ocr-steps-timelines-and-examples
Supporting evidence (2)
Under federal HIPAA breach reporting guidelines, for breaches affecting 500 or more individuals, you must report to HHS OCR without unreasonable delay and no later than 60 calendar days after the breach discovery date.
Read supporting passage
For breaches affecting 500 or more individuals, you must report to HHS OCR without unreasonable delay and no later than 60 calendar days after the breach discovery date.
Covered entities must also notify affected individuals without unreasonable delay and no later than 60 calendar days after the breach discovery date.
Read supporting passage
Notify affected individuals without unreasonable delay and no later than 60 calendar days after the breach discovery date.