Key Takeaways

  • Central Ohio Primary Care said a vishing attack exposed files containing protected health information and other sensitive records.
  • Approximately 1.4 million people may be affected, although COPC said MyChart was not compromised and no misuse has been identified.
  • The incident highlights the growing business risk posed by social engineering, identity compromise and concentrated healthcare data.

Central Ohio Primary Care has disclosed that approximately 1.4 million people may be affected by a cybersecurity incident involving unauthorized access to files containing protected health information. COPC discovered the attack on Aug. 25, 2026, and described the initial intrusion method as vishing, or voice phishing.

Potentially exposed information varies by individual. It may include names, addresses, Social Security numbers, patient identification numbers, limited health information, financial information and other identifiers. That combination creates risks extending beyond payment-card fraud. Social Security numbers and healthcare identifiers can remain useful to criminals for years, particularly when combined with addresses and medical details.

COPC said it has not identified misuse of the exposed information. It also said Epic's MyChart patient portal was not affected, an important distinction because patients commonly associate their portal account with the healthcare provider's entire technology environment. The incident instead involved unauthorized access to files elsewhere in COPC's systems.

According to The Columbus Dispatch, the breach involved private patient information held by the large primary-care group. COPC is working with identity-monitoring provider IDX to offer services to affected individuals.

Vishing can look deceptively low-tech compared with malware or a software vulnerability. An attacker calls an employee, impersonates a trusted person and tries to obtain credentials, reset an account or persuade the employee to approve access. The technical controls may be functioning as designed, yet the attacker still gets through because the human interaction appears plausible.

That makes the incident relevant well beyond COPC. Security programs often devote substantial attention to email phishing while treating telephone-based impersonation as a secondary concern. With attackers able to collect employee information from public sources and use artificial intelligence to improve scripts or imitate voices, help desks and account-recovery processes have become valuable targets. How thoroughly are sensitive access requests verified when the person applying pressure sounds convincing?

Separate breach-tracking reports and several class-action law firms have pointed to Chaos, a ransomware group, in connection with the incident. That attribution should be treated carefully. COPC's public account identifies vishing as the means of access but does not establish in its notice that Chaos was responsible. A reported ransomware connection and a confirmed technical attribution are not the same thing.

The broader numbers explain why healthcare remains attractive. The Privacy Rights Clearinghouse found that healthcare accounted for 66% of individuals affected by U.S. breach notifications in 2025, based on its compilation of government filings. Recent incidents involving Change Healthcare, Yale New Haven Health and AllerVie Health further illustrate how healthcare records can be exposed through organizations of very different sizes and functions.

Change Healthcare's 2024 ransomware incident ultimately affected approximately 192.7 million people. Its scale showed how one healthcare intermediary can create systemic exposure across patients, providers and business partners. COPC's breach is different in scope and reported entry method, but the underlying business issue is similar: healthcare organizations aggregate unusually durable identity and medical data.

For security leaders, the response goes beyond adding another awareness module. The NIST Cybersecurity Framework 2.0 offers a useful structure for examining governance, identity controls, detection, response and recovery. In practice, organizations can test help-desk verification, restrict privileged access, require phishing-resistant authentication where feasible and monitor unusual file activity after account changes.

HIPAA Security Rule obligations also keep the focus on administrative, physical and technical safeguards rather than on a single product. No control eliminates social engineering. Layered verification, narrower access and faster detection can, however, reduce the chance that one persuasive phone call becomes a breach affecting 1.4 million people.