The breach was the result of a voice phishing (vishing) attack in August of 2026.

 

What happened

Central Ohio Primary Care (COPC), which operates over 80 locations throughout Central Ohio, recently announced that a voice phishing attack resulted in an unauthorized third-party obtaining credentials that allowed them into the health center’s internal systems.

According to their notice, the attack was discovered and stopped on August 25th, 2026, but COPC did not state when the attack was initiated or what happened during the vishing call. According to a local news outlet, the incident affected an estimated number of 1.4 million individuals.

 

Going deeper

COPC noted the breach impacted information like patient names, addresses, Social Security numbers, financial information, health information, and other identifying information.

The incident was contained to only COPC’s direct system, and other systems, like MyChart, were not impacted. COPC also said that they are not currently aware of any misuse of the data or fraud stemming from the incident.

 

In the know

While COPC has not confirmed who was responsible for the data breach, ransomware-as-a-service organization Chaos claimed responsibility for the incident. The relatively new ransomware group first emerged in 2025, according to Ransomware Live. The malicious group is believed to be founded by former members of the ransomware gang BlackSuit/Royal, which was disrupted by the Department of Justice in 2025. Currently, Chaos has an estimate of 96 victims, most of which have been healthcare organizations, like the attack against Park Dental Partners which has currently resulted in four state court lawsuits.

While little is known about Chaos as a group, reports have found that the original tools were developed in the Ukraine. Since then, the group has some association with Iran, but has not been labeled as a state-sponsored group.

 

What’s next

In a local news report, cybersecurity expert Shawn Waldman noted that the combination of data (names, Social Security numbers, and addresses) can be especially valuable when “combined with things like patient ID and financial information…We’re talking credit cards can be opened, bank accounts. This is a severe compromise of personal, identifiable information or patient health information can be really disastrous.” These impacts don’t just directly impact victims, who will now have to monitor for credit and fraud, but also have an impact on COPC’s ability to financially recover. These situations can also impact patient trust, leading to a poorer reputation.

If the situation severely impacts victims, it’s more likely to result in a large lawsuit, which could be anywhere from several hundred thousand dollars to several million. With the number of individuals impacted, it could have a negative impact on COPC’s financial state, especially as the organization continues to recover from the incident. While the overall cost of a data breach can vary greatly, Paubox reports have found that the average cost of a healthcare data breach (including lawsuits and operational costs) is approximately $7.42 million.

 

FAQs

Why hasn’t COPC provided details about when the attack was initiated?

COPC isn’t required to publicly reveal when an attack was initiated. It’s also possible that they are continuing to investigate the incident and are not ready to provide that information to the public.

 

What is voice phishing?

Vishing is when attackers use phone calls instead of emails or software to manipulate victims. Threat actors may pose as IT or as part of the operational team. These attacks can be difficult to prepare against, since individuals usually don’t see them coming and calls allow the attacker to build trust with the victim. In these cases, victims often hand over passwords or even allow remote desktop control without realizing it’s an attack.