Central Ohio Primary Care Physicians, Inc. (COPC), the largest physician-owned primary care group in the United States — confirmed a cybersecurity breach discovered August 25, 2026, that exposed the personal information of approximately 1.4 million patients and employees. A voice phishing scam (vishing) gave an attacker unauthorized access to files containing names, addresses, Social Security numbers, financial information, and limited health data. COPC says the breach has been contained, no misuse has been detected, and Epic MyChart was not affected. Complimentary credit and dark web monitoring is available through IDX at response.idx.us/copc.
How the Attack Worked
The technique is called vishing, voice phishing, and it’s the fastest-growing threat in healthcare IT security right now.
Where email phishing sends a malicious link and hopes someone clicks, vishing calls a real person and impersonates a trusted authority until that person provides access, credentials, or takes a financial action. According to enterprise cybersecurity researchers at Vectra AI, voice phishing incidents surged 442% in late 2024 and accounted for more than 60% of phishing-related incident response engagements heading into 2026. The shift is partly driven by AI voice-cloning technology, which lets attackers synthesise convincing calls that sound like IT support, vendors, or internal colleagues.
In COPC’s case, the call “sought a financial response” and resulted in the attacker gaining access to files containing protected health information, according to reporting by WSYX ABC6. The specific nature of the social engineering isn’t fully disclosed, but the pattern is well-documented: a caller convinces a frontline staff member that they’re responding to a legitimate business need, and that one interaction becomes the breach vector.
This healthcare vishing wave isn’t isolated to COPC. In August 2026, the American Hospital Association published a specific warning about a ShinyHunters-linked social engineering and identity-targeting campaign targeting healthcare organisations. ShinyHunters, the same group connected to the Streamlabs breach and activity across the Twitch creator ecosystem, has increasingly turned toward healthcare targets in 2026 because the sector holds exactly the data combination most valuable for identity fraud: names, Social Security numbers, and health identifiers all in one database.
The Chaos Ransomware Layer
A detail that the official COPC breach notification doesn’t emphasise, but that surfaced in cybersecurity briefings shortly after the August 25 discovery: a Morning Cybersecurity Update video from August 28, 2026 described the COPC incident specifically as a ransomware attack carried out by the Chaos ransomware group.
At that point, the reported impact was over 500,000 people. By the time official HIPAA notifications went out in October, the confirmed figure had grown to 1.4 million.
The jump from 500,000 to 1.4 million is significant and worth understanding. COPC’s website states it serves over 500,000 patients across 80+ practice locations. The 1.4 million figure clearly extends well beyond the current active patient base. It reflects how healthcare records accumulate: former patients, multi-year histories, employees and dependents, referring clinicians, and others whose information sat in systems accessed during the attack. Healthcare records don’t get deleted when a patient stops visiting. They persist. And in this breach, the attacker had time to access them before COPC shut down the compromised access on August 25.
What Was in the Exposed Files
COPC’s official notification lists the following categories of potentially exposed data:
Full names, addresses, Social Security numbers, financial information, limited health-related patient data including patient ID numbers, and other identifying information.
The combination that matters most here is Social Security numbers alongside health data. Financial records paired with SSNs enable identity theft, fraudulent credit applications, tax refund fraud, and account takeovers. Health records specifically enable medical identity theft: using someone’s information to fraudulently obtain prescriptions, medical equipment, or healthcare billing. This is why healthcare data is consistently the highest-value category in dark web credential markets, as we’ve covered in looking at how stolen identity components fuel the synthetic fraud market. A healthcare record with SSN doesn’t just enable one type of fraud, it enables several simultaneously.
One important item confirmed safe: Epic MyChart, the patient portal that COPC patients use to communicate with their providers and access health records, was not impacted. Patients can continue using MyChart normally.
COPC’s Response and What They’re Offering Patients
COPC confirmed it engaged cybersecurity experts, worked with law enforcement, and has contained the breach. CEO Don Deep stated in a public release that the company is implementing enhanced security protocols to protect its systems and the people who trust it with their information. No misuse or attempted misuse of the exposed information for identity theft or fraud has been reported.
The company is offering complimentary credit and dark web monitoring through IDX, a standard but meaningful post-breach protective measure — covering potentially all 1.4 million affected individuals.
If you are a COPC patient or were ever a COPC patient, here’s where to go: response.idx.us/copc is the dedicated portal where you can confirm whether your records were affected and sign up for the IDX monitoring service. Written notification letters are going to affected individuals using contact information on file. COPC has also set up a dedicated call centre.
For those who may not receive a letter but suspect they were patients of COPC-affiliated practices at any point in recent years, checking the portal is the right first step. The broader checklist for what to do when your healthcare or personal data has been exposed is covered in our dark web data exposure guide.
The HIPAA Clock Was Already Running
COPC discovered the breach on August 25. Under HIPAA’s Breach Notification Rule, covered entities must notify affected patients and report to the federal Department of Health and Human Services within 60 calendar days of discovery, putting the federal deadline around October 24.
Ohio adds its own layer. Under Ohio Revised Code § 1349.19, notification must happen in “the most expedient time possible” and no later than 45 days from discovery, a deadline that likely landed around October 9. When a breach affects more than 1,000 Ohio residents, state law also requires notification to major consumer credit reporting bureaus.
These overlapping timelines mean COPC had less runway than the 60-day HIPAA figure implies. The fact that notifications only started reaching patients around October 15-16 may prompt scrutiny of the Ohio-specific 45-day obligation.
The HHS Office of Civil Rights maintains a public breach reporting portal. Cases involving 1.4 million individuals are automatically added to its public “Wall of Shame” database, which also triggers potential investigation of whether the organisation’s security policies met HIPAA’s required standards before the breach occurred.
Why Healthcare Keeps Getting Hit
COPC is not an isolated case. As we covered in our look at the dark web intelligence market and what’s driving its 21% growth, healthcare is consistently the second most targeted sector in US cybercrime after financial services. A 2026 report by CyberCX specifically found healthcare more vulnerable to business email compromise and social engineering than other sectors, attributing this to the high concentration of small and medium-sized practices, GP clinics, specialist offices, care groups — that operate with lower security maturity.
Primary care networks like COPC sit in a particularly exposed position. They aggregate records across decades of patient care, employ large non-clinical administrative workforces who handle sensitive data, and typically have fewer dedicated security resources than hospital systems. A single vishing call to the right person can open access to decades of records across hundreds of thousands of individuals.
Frequently Asked Questions
What happened at Central Ohio Primary Care?
A voice phishing scam (vishing) gave an attacker unauthorized access to COPC’s systems. The breach was discovered on August 25, 2026, and is also referenced in cybersecurity briefings as a Chaos ransomware attack.
How many people were affected?
Approximately 1.4 million patients and employees.
What information was exposed?
Names, addresses, Social Security numbers, financial information, limited health data including patient ID numbers, and other identifying information.
Was Epic MyChart affected?
No. Patients can continue using MyChart normally.
What should affected patients do?
Visit response.idx.us/copc to check your status and enroll in free IDX credit and dark web monitoring. Report any suspected identity misuse to the FTC at IdentityTheft.gov.
