Central Ohio Primary Care Physicians (COPC), a group with more than 80 locations in central Ohio, said in mid October 2026 that an incident it discovered on 25 August affected about 1.4 million people. It attributes the access to a phone based social engineering scam.
What is confirmed
As stated by COPC and reported by NBC4 and Spectrum News on 15 and 16 October 2026:
- COPC discovered the incident on 25 August 2026.
- A social engineering phone scam let a criminal gain unauthorized access to certain files containing protected health information.
- Approximately 1.4 million people were affected, per the initial investigation.
- Data may include name, address, Social Security number, limited health data such as a patient ID number, and financial information.
- The MyChart (Epic) portal was not affected.
- COPC says it knows of no misuse of the information for identity theft or fraud, and is offering credit and dark web monitoring through IDX.
What is reported
- Media, citing leak site monitoring, say a group calling itself Chaos claimed the attack. COPC has not named a group in the statements we found.
- One outlet estimated between roughly 263 and 362 gigabytes of data. We could not verify that figure.
- Breach tracker pages indicate the exposure may also include employee data. We found no COPC text confirming this.
What is not known
Which employee was targeted, which files were reachable, whether data was encrypted as well as copied, whether a ransom was paid, and which regulator filing carries the 1.4 million figure. The IDX response page we fetched is an enrollment page and carries no incident detail.
What to do now
- If you are a COPC patient, enroll in the offered monitoring if you receive a letter, and consider a credit freeze and an IRS Identity Protection PIN.
- Treat any call claiming to be from COPC as suspect. Hang up and use the number on your card or statement.
- For any organization: write down how a caller proves who they are before staff reset a credential, change a payment detail or open a file share. Make that rule apply to callers who sound senior.
How this could have been avoided
COPC says the entry point was a phone scam. The controls that address that path are callback verification for any request by phone, no password or MFA resets by voice alone, and tight limits on which staff can reach files with patient identifiers. Phishing resistant MFA and short lived access to file shares reduce what one tricked employee can open.
Quick check
Which parts of the COPC story come from COPC itself?
The discovery date, the phone scam, the 1.4 million figure, the data types and the monitoring offer. The group name and the data volume come from outside monitoring and are unverified.
