It started with a phone call
No malware-laced email. No zero-day exploit. According to Central Ohio Primary Care, the August attack that exposed the health data of more than 1.4 million people began with vishing: voice phishing, a phone call designed to trick someone into handing over access. It worked.
On October 15, COPC acknowledged what happened. COPC said the attack was carried out to extort money, and the threat actor gained unauthorized access to files containing protected health information. Current patients, former patients, employees. Over 1.4 million people total.
COPC describes itself as the largest physician-owned primary care group in the United States, with more than 80 locations across central Ohio serving over 500,000 patients. The 1.4 million figure covers a wider net: current and former patients plus current and former employees.
What was actually exposed
COPC said the exposed data included names, addresses, Social Security numbers, “limited” patient health data, financial information, and patient ID numbers, among other identifying information. The company noted that not every affected person had every data type exposed.
The SSN exposure changes the math. A credit card number can be cancelled. Health records cannot be reissued. And a Social Security number paired with a name and address is the core kit for new-account fraud. This is why the standard advice here is not just “monitor your credit” but freeze it.
Stolen health data also enables medical identity theft: someone else’s treatments billed to your name, prescriptions filled under your identity, insurance claims you never filed. The damage often surfaces months later, on an explanation-of-benefits statement you barely glance at.
Were you a COPC patient? What should you do right now?
Start with the free help COPC is offering, then lock down your credit.
- Sign up for COPC’s free credit and dark web monitoring at response.idx.us/copc, or call 866-200-0918 (9 a.m. to 9 p.m. ET, Monday to Friday).
- Freeze your credit at all three bureaus. With SSNs exposed, a freeze beats a fraud alert.
- Review every explanation-of-benefits statement from your insurer for treatments you never received.
- Check that your MyChart portal login still works normally. COPC says it was not affected.
- File a report at identitytheft.gov if you find medical charges that are not yours.
- Keep every breach letter and notice. Class-action firms are already investigating this incident.
The six-week gap, with context
COPC discovered the attack on August 25 and announced it on October 15. That is roughly six weeks. But the raw timeline misses important context: the HIPAA Breach Notification Rule gives covered entities 60 days from discovery to notify victims. August 25 plus 60 days is October 24. COPC came in under the legal deadline.
The harder question is whether the 60-day window itself makes sense when Social Security numbers are involved. Law firms were publicizing this breach as early as August 27, while patients waited for official word from the company until mid-October. Legally compliant and reassuring are not the same thing.
Two things COPC says are fine
MyChart was not affected by the attack, and COPC says patients can keep logging into the portal as usual. The company also says it is not aware of any misuse or attempted misuse of the exposed data so far, though the investigation is still going.
What is claimed but not confirmed
Several class-action law firms say the Chaos ransomware group has taken credit for the attack, and monitoring sites report COPC appearing on Chaos’s dark-web leak site on August 25-26. COPC has not confirmed any of this. The company has not publicly attributed the attack to Chaos or any named group.
The same caution applies to the data volume. One monitoring figure puts it at roughly 362 gigabytes; earlier reporting referenced about 263GB. Neither number comes from the company. Treat both as unverified.
What is confirmed: the vishing vector, the August 25 discovery date, the October 15 acknowledgment, the 1.4 million figure, and the exposed data types listed above. Everything else is still developing.
Sources
- Columbus Dispatch, October 15, 2026
- Edelson Lechtzin LLP investigation announcement via PR Newswire, August 27, 2026
- SOCRadar breach monitoring, accessed October 16, 2026
Correction (October 16, 2026): An earlier version of this article said COPC had not published an itemized list of exposed data types. COPC did specify the data types, including Social Security numbers. The article has been updated with the company’s stated data types, the free monitoring offer, and the HIPAA notification-deadline context.
