1.4 Million People Tied to a Central Ohio Primary Care Breach: Seven Steps If You May Be Affected
Central Ohio Primary Care says an August vishing attack exposed files for about 1.4 million patients and employees. Here is a plain seven-step walkthrough of what COPC disclosed and what to do next.
Central Ohio Primary Care Physicians (COPC), a large physician-owned primary care group with more than 80 locations, updated its public notice on October 15 about a cybersecurity incident discovered on August 25. The initial investigation points to roughly 1.4 million individuals.
This walkthrough follows COPC’s own cybersecurity information page. Local television reporting from NBC4 Columbus separately said sources named the ransomware group Chaos; COPC’s public page describes a vishing-driven intrusion and does not name a group.
Seven steps
- Understand how COPC says it started. COPC states the incident resulted from a social-engineering or “vishing” (voice phishing) attack aimed at soliciting a financial response. A criminal actor then gained unauthorized access to certain files containing protected health information.
- Note the scale and data types. About 1.4 million people may be impacted. Potentially exposed information may include name, address, Social Security number, limited health-related patient data including patient ID number, financial information, and other identifying details. Not every person necessarily had every field exposed.
- Hear what was not hit. COPC says the incident has been contained with no further unauthorized access, and that MyChart (Epic) was not impacted—patients can keep using the portal.
- Watch for mail, then use the portal if needed. People with contact information on file are to receive written notice. Others who believe they may be impacted can visit response.idx.us/copc (password COPCP2026 per COPC’s page) to check status and request a credit-monitoring code.
- Use the support COPC is funding. COPC is providing complimentary credit and dark-web monitoring through an IDX Identity Theft Protection Plan and opened a call center at (866) 200-0918, Monday through Friday, 9 a.m. to 9 p.m.
- Treat follow-up contacts carefully. COPC’s earlier guidance still applies: do not give personal information unsolicited by phone, email, or text; delete texts from unknown numbers; do not reply to emails asking for money; do not click links in messages you do not recognize. Attackers often recycle breach news into fresh scams.
- Separate rumor from disclosure. NBC4 reported that sources attributed the intrusion to the ransomware group Chaos and quoted CEO Don Deep on enhanced security protocols. COPC’s official page emphasizes vishing, containment, and monitoring offers. If you are deciding what to tell staff or patients, prefer the organization’s written notice and any letter you receive.
What this means for your company
Healthcare clinics and any business that stores Social Security numbers learn the same lesson: a convincing phone call can bypass a lot of expensive tooling. Train people who can move money or unlock accounts to verify unusual requests on a known-good number, limit who can reach sensitive file shares, and practice how you will notify customers if a vendor or clinic you work with is the one sending letters. If your company shares data with medical partners, ask how they authenticate phone requests and how quickly you would hear about an incident that includes your employees.
Need help building a vishing-resistant process and a breach-notification playbook for customer data? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
