-
Central Ohio Primary Care Physicians revealed that a vishing attack has potentially compromised the records of over a million individuals.
-
The attack possibly compromised private information, including names, addresses, social security numbers, financial and health records.
-
COPC says MyChart was not affected and the incident is contained. It is notifying affected people and offering free credit and dark web monitoring.
Central Ohio Primary Care Physicians (COPC) has made a new statement regarding its probe into a cybercrime that could have compromised confidential data of 1.4 million persons. The healthcare provider detected the breach on August 25, 2026, when a voice-phishing attack allowed the attacker access to private data.
As a result, affected sensitive information includes, names, addresses, Social Security numbers, financial information, and certain health information. COPC says the incident is now contained, but its investigation continues. The organization is notifying affected people and offering free credit and dark web monitoring.
Voice-Phishing Attack Led to Data Exposure
COPC shared the updated figures on October 15, raising concerns about the scale of the incident. A preliminary inquiry suggests the attack may have impacted around 1.4 million patients and staff of the organization.
The incident involved the use of voice phishing, commonly referred to as vishing. It is a method where calls to individuals can facilitate the acquisition of sensitive information or access to computer systems. Among other approaches, scammers may impersonate a well-known organization or the company where the victim works.
Unlike other approaches that depend solely on malicious software, vishing relies on human trust. Criminals are capable of persuading employees to disclose their password or do something that compromises security. If they gain access to the system, they will be able to find valuable data.
COPC said the attacker accessed files containing protected health information. However, it remains unknown whether the breached data is the same for all the victims. The investigations are still in progress.
The problem demonstrates the vulnerabilities healthcare organizations face in dealing with personal information. Medical institutions possess sensitive data that attackers may exploit for criminal purposes.
Names, Financial Details and Health Data at Risk
COPC identified several types of information that the breach may compromise. The details include names, addresses, Social Security numbers, financial data, and some health data. The organization also reported a potential leak of patient IDs.
The Social Security number is a high-value target for criminals because they can utilize it to commit identity fraud. When coupled with addresses and names, it is possible to steal the identity of someone with ease. Similarly, the risk applies to financial information, which can lead to instances of fraud.
Health information creates another concern. Even limited medical details can reveal the connection of a person to a healthcare provider. Patient identification numbers may also help criminals make their messages or calls appear more convincing.
However, COPC has not reported confirmed identity theft or fraud linked to this incident. The organization says it has not identified such cases so far. However, that doesn’t assure that criminals could not find means to utilize the data.
The investigation should determine how widely the crime has spread. And until the conclusion of the investigation, it is essential that affected individuals remain cautious and pay attention to any suspicious activity regarding their personal data and finances.
COPC Says MyChart Remains Safe
COPC confirmed that its MyChart service, which runs on Epic, suffered no impact from the incident. MyChart allows patients to access health information and manage parts of their care online.
This distinction matters because patients may worry that the attack also exposed their online medical accounts. COPC has stated that the breach did not affect MyChart. However, the incident involved other files containing protected health information.
The organization says it has contained the incident and is working with cybersecurity experts to assess the damage. It is also reviewing the event to understand what happened and strengthen its security measures.
Meanwhile, COPC is notifying affected individuals by letter. Those notifications should explain the incident and the available support. The organization is also offering complimentary credit and dark web monitoring.
Credit monitoring can alert people to certain changes in their credit records. The use of dark web monitoring checks help to detect occurrences of private information in places where criminals trade stolen information. Hence, these services can warn individuals about probable threats, but they cannot eliminate any form of fraud.
People receiving any kind of notification should pay attention to it and comply with only instructions. They should also be careful with unsought phone calls, emails, or text messages offering their assistance in dealing with the breach.
Healthcare Organizations Face Growing Security Risks
The issue surrounding COPC demonstrates how one attack can simultaneously affect many people. Healthcare providers collect personal plus medical information to ensure proper delivery of healthcare services such as treatment, appointments, billing, etc. This makes healthcare systems susceptible to attack.
A separate report has raised similar concerns about healthcare data security in France. A hacker claims to be offering a large collection of French healthcare data, but the authenticity of the alleged leak remains unverified.
In addition, attackers can make use of social engineering to fool some security measures. Instead of attacking technical security, they can influence people working for the organization and persuade them to provide personal access. Training employees to identify suspicious calls reduces this problem.
Furthermore, healthcare organizations can secure their accounts by enabling multi-factor authentication. This method introduces another authentication stage aside from that of the password. They also have to restrict access to sensitive documents and monitor abnormal activity in their systems.
Also, companies need to develop a strict strategy for incident response. Quick detection, thorough investigation, & fast communication are major means of limiting losses. Also, periodic security auditing is beneficial for the discovery of vulnerabilities prior to their use by attackers.
For COPC, the investigation remains ongoing. The organization has not yet provided a final account of every record involved.
