COLUMBUS, Ohio — Approximately 1.4 million people have been affected by a cybersecurity breach involving Central Ohio Primary Care Physicians (COPC), one of the nation’s largest physician-owned primary care organizations.
The breach, discovered on August 25, exposed sensitive personal information, including Social Security numbers, financial records and certain patient health information.
COPC, which operates more than 80 locations throughout central Ohio, confirmed the extent of the incident as it prepares to notify affected individuals.
According to COPC, the incident involved a voice phishing attack, commonly known as vishing, in which attackers attempted to obtain money through deceptive communications.
The attack allowed a ransomware group to gain unauthorized access to protected information. Sources identified the group as “Chaos,” although the investigation remains ongoing.
The compromised information may include names, home addresses, Social Security numbers, financial details and limited medical information.
Cybersecurity experts warn that this combination of personal data can create significant risks for identity theft and financial fraud.
COPC says the security incident has been contained and that patients can safely continue using the organization’s MyChart portal.
The healthcare provider also reports that it has not identified evidence of personal information being misused for identity theft or fraud as a result of the breach.
Affected individuals will receive notification letters by mail explaining the incident and available assistance.
COPC is offering credit monitoring and dark web monitoring services at no cost to those impacted.
The organization has also announced additional security measures intended to strengthen its systems and prevent future incidents.
Individuals who believe their information may have been compromised are encouraged to monitor their financial accounts, review credit reports and consider placing a freeze on their credit files.
Additional precautions include obtaining an IRS Identity Protection PIN and remaining alert for suspicious emails, phone calls or unexpected financial activity.
Patients should also be cautious of anyone contacting them and requesting personal information while claiming to represent COPC.
For additional information about the breach and available assistance, visit the official incident response website: https://response.idx.us/copc
The investigation remains ongoing as COPC works to notify affected individuals and address the security incident.
Source: NBC4 WCMH-TV — Isabel Cleary, “1.4 million impacted by Central Ohio Primary Care Physicians data breach,” published October 15, 2026; updated October 16, 2026.
