Central Ohio Primary Care Physicians (COPC), one of the largest independent physician-owned primary care groups in the United States with more than 80 locations across Central Ohio, has disclosed a breach affecting approximately 1.4 million current and former patients after a voice-phishing (vishing) attack in August 2026 yielded third-party access to internal systems. The unauthorised access was detected and blocked on 25 August 2026, but the investigation confirmed that files were exfiltrated containing patient names, addresses, Social Security numbers, financial information, health information and other identifiers, covering patients past and present. Notification letters are being mailed with complimentary credit monitoring, identity-theft protection and dark-web monitoring, and the group says it has found no misuse of the data to date. No threat group was named in the breach notices, but the HIPAA Journal reports the incident appears to be the work of the Chaos ransomware group, which listed the practice on its dark-web leak site and threatened to publish the stolen data before the listing was withdrawn. It is one of the largest US patient-data breaches disclosed this year and shows vishing remains an effective first-stage route into healthcare networks.

• Source article