COLUMBUS — Central Ohio Primary Care acknowledged on Thursday, Oct. 15, that an August cyberattack compromised protected health and personal information belonging to more than 1.4 million current and former patients and employees.
The physician practice, one of the largest primary care organizations in the country, said it first discovered the attack on Aug. 25 but did not publicly announce it for about a month and a half. The breach grew out of a “vishing,” or voice phishing, attack carried out to extort money from the organization.
In a vishing attack, a criminal pretends to be a trusted voice — someone from a human resources department or a government agency, for example — to trick a target into giving up access. COPC said a criminal threat actor gained unauthorized access to certain files containing protected health information, though the practice declined to detail who the attacker impersonated and confirmed the scam was not directed at patients.
The exposed information included names, addresses, Social Security numbers, limited patient health data and financial information, among other identifiers. COPC cautioned that not every affected person had every type of data exposed, and said its MyChart patient portal was not impacted, so patients can keep logging in as usual.
COPC said it is not aware, so far, of any misuse or attempted misuse of the breached data. When the attack was discovered, the organization said it began working with authorities and cybersecurity professionals to assess the exposure, reinforce security and prevent future incidents, and it continues to cooperate with law enforcement while the full extent of the attack remains under review.
CEO Dr. Don Deep said the practice takes the matter seriously and is putting enhanced security protocols in place to protect its systems, its team members and everyone who trusts it with personal information.
Several class-action law firms have already launched investigations into the breach, and reports have pointed to a ransomware group known as Chaos, active since early 2025 and known for voice-phishing attacks over Microsoft Teams, as having claimed credit for the incident.
For patients, COPC is offering free credit and dark web monitoring services. People with contact information on file will receive written notification; anyone who believes they were affected but does not get a letter can request confirmation and sign up for monitoring through the response site the practice has set up, or call its dedicated center at 866-200-0918, open 9 a.m. to 9 p.m. Monday through Friday. The practice also warned patients to stay alert for scams exploiting the attack, and to verify any suspicious message claiming to be from COPC by contacting their doctor’s office directly rather than clicking links or sharing information.
