Central Ohio Primary Care Physicians, Inc. says a cybersecurity incident tied to a voice phishing scam may have exposed the personal information of roughly 1.4 million patients and employees. The physician network says it discovered the breach on August 25, and the exposed data may include Social Security numbers, addresses, financial information, and limited health records.
According to WSYX, the breach began with a social-engineering phone scam that sought a financial response and enabled a criminal threat actor to gain unauthorized access to files containing protected health information. COPC is the largest physician-owned primary care group in the country, founded in 1996 by 33 physicians and now operating more than 80 practice locations serving over 500,000 patients across central Ohio, according to Central Ohio Primary Care. That scale means a breach of this size touches a broad cross-section of the region's households.
The station's report indicates COPC engaged cybersecurity experts to assess and contain the incident and worked with authorities and outside professionals to evaluate the exposure, reinforce its defenses, and try to prevent future incidents. The company says the incident has been contained and it has seen no further unauthorized access in its systems. Importantly, per the same account, the Epic MyChart portal was not impacted, and patients can continue using it to connect with their providers.
CEO Says Enhanced Security Protocols Are Underway
CEO Don Deep, who took over the role on January 1, 2023, after succeeding longtime leader Dr. William Wulf, said in a statement that COPC takes the matter seriously and is implementing enhanced security protocols to protect its systems, team members, and the people who entrust it with personal information, the report notes. Deep added that affected people's peace of mind and confidence in COPC are important to the organization.
COPC says it is not aware of any misuse or attempted misuse of personal information for identity theft or fraud stemming from the incident. The potentially exposed information includes first and last names, addresses, Social Security numbers, financial information, limited health-related patient data including patient ID numbers, and other identifying information, per the same account.
A Wave of Phone-Based Scams Targeting Hospitals
The vishing tactic described in COPC's breach fits a pattern cybersecurity groups have flagged with growing alarm. In August 2026, the American Hospital Association published a warning about a ShinyHunters-linked social-engineering and identity-targeting campaign.
That warning tracks with broader industry data. Enterprise cybersecurity analytics from Vectra AI show voice phishing incidents surged 442% in late 2024 and accounted for more than 60% of phishing-related incident response engagements into 2025 and 2026, a shift researchers attribute partly to advances in AI voice cloning that have made phone-based credential theft far more convincing. Hoodline previously reported on a similar scheme targeting Harvard affiliates through fake IT impersonation calls.
Video Describes COPC Incident as Chaos Ransomware Attack
A MORNING CYBERSECURITY UPDATE video from August 28, 2026, described the COPC incident as a ransomware attack by the Chaos group and said it affected more than half a million people.
What Affected Patients and Employees Should Do
COPC says it will send written notification to impacted individuals using contact information on file. People who believe they may be affected but do not receive a letter can visit response.idx.us/copc for information, impact confirmation, and a credit-monitoring sign-up code. The company's letter and website outline steps to safeguard personal information, sign up for IDX credit monitoring, and place security freezes on credit profiles.
COPC has established a dedicated call center to address concerns and provide additional support, and it is offering complimentary credit and dark web monitoring through the IDX identity theft protection plan. The monitoring offer could extend to as many as 1.4 million people. COPC says it will continue working with third-party experts and following best practices along with federal and state regulations intended to protect affected individuals.
Regulatory Timeline Under Both State and Federal Law
The breach notification also intersects with overlapping legal deadlines. Under the federal HIPAA Breach Notification Rule, healthcare providers must report breaches affecting 500 or more individuals to patients and federal regulators without unreasonable delay and no later than 60 calendar days after discovery, according to Patient Protect. Separately, Ohio Revised Code § 1349.19 requires notification in the most expedient time possible and no later than 45 days after discovery, unless delayed by law enforcement requests or system restoration needs, per Medcurity. Ohio law also requires notice to major credit reporting bureaus when a breach affects more than 1,000 state residents.
COPC is based in Westerville. The breach adds a new layer of scrutiny to one of the Columbus suburb's largest employers as it works to reassure patients and staff that their information is being protected going forward.
