Central Ohio Primary Care Physicians suffered a vishing attack in August 2026 that let an unauthorized party steal files containing names, Social Security numbers, financial information, and health data for about 1.4 million patients. The breach was discovered and stopped on August 25, 2026, with notifications mailed in October 2026. Affected patients should enroll in the free credit monitoring and identity protection services offered and watch their accounts closely.
| Company | Central Ohio Primary Care Physicians |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names, Home Addresses, Social Security Numbers, Financial Information, Health Information |
| People Affected | 1.4 million patients |
| Attack Method | Voice Phishing/Unauthorized Access |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Central Ohio Primary Care Physicians Data Breach?
Central Ohio Primary Care Physicians has confirmed a major data breach affecting current and former patients. The Westerville-based medical group operates more than 80 locations across Central Ohio. It is one of the largest independent, physician-owned primary care organizations in the country.
According to the organization, unauthorized access to its network occurred in August 2026. The attack began as a voice phishing scheme, often called vishing (voice phishing), in which someone tricked a staff member into handing over login credentials. Those stolen credentials then gave an outside party entry into internal systems. As a result, the intruder was able to view and copy files containing patient data before the activity was discovered and stopped on August 25, 2026.
Once the intrusion was detected, the organization launched a forensic investigation to determine what had happened and which files were affected. This review confirmed that files containing sensitive patient information had indeed been taken from the network. Because reviewing large volumes of exfiltrated files takes time, the full scope of the incident was not finalized until months later, which is why notification letters only went out in October 2026.
Although the breach notices themselves did not name an attacker, public reporting indicates a ransomware group calling itself Chaos claimed responsibility. The group reportedly added Central Ohio Primary Care Physicians to its dark web leak site and threatened to publish the stolen files unless payment was made. However, the organization is no longer listed on that site, suggesting the listing was later removed.
Who was affected?
The breach affects approximately 1.4 million current and former patients of Central Ohio Primary Care Physicians. This is a substantial number of people, reflecting the scale of the medical group’s patient base across its many Central Ohio locations.
Because the organization serves primary care patients of all ages, the affected population likely includes children, adults, and senior citizens. In addition, both current patients and people who were previously treated by the practice may be impacted. The notification letters sent in October 2026 were the first time many individuals would have learned their information was involved.
What Information Was Potentially Exposed?
Central Ohio Primary Care Physicians confirmed that the exfiltrated files contained several categories of sensitive personal and medical information. This data could be valuable to criminals looking to commit identity theft or insurance fraud.
- Full names
- Home addresses
- Social Security numbers
- Financial information
- Health information
- Other personal identifying information
Because Social Security numbers and financial details were included, affected patients face a heightened risk of identity theft. Criminals can use this combination of data to open new credit accounts, file fraudulent tax returns, or apply for loans in someone else’s name. This type of fraud can be difficult to detect right away and may take months to fully unwind.
The presence of health information adds another layer of risk. Stolen medical details can be used for medical identity theft, where someone uses a victim’s identity to obtain treatment or prescriptions. In addition, health data can be exploited for targeted phishing scams that pose as legitimate healthcare communications, making them harder for victims to recognize as fraudulent.
What is the company doing?
Central Ohio Primary Care Physicians says it is mailing notification letters to everyone affected by the breach. Alongside these letters, the organization is offering complimentary credit monitoring, identity theft protection, and dark web monitoring services to help patients watch for signs of misuse.
The organization has stated that it has not found any evidence that patient information has actually been misused since the incident occurred. Still, it is offering these protective services as a precaution. Central Ohio Primary Care Physicians has also said it had security measures in place before the attack and has since strengthened its defenses to reduce the chance of a similar incident happening again.
What Should Affected Individuals Do?
Monitor Your Credit Reports Closely
Affected patients should request copies of their credit reports and review them for unfamiliar accounts or inquiries. You can get free reports from each of the three major credit bureaus through AnnualCreditReport.com.
Because Social Security numbers were exposed, the risk of new-account fraud is real. As a result, checking your reports regularly, rather than just once, gives you a better chance of catching fraudulent activity early before it causes lasting damage.
Consider a Credit Freeze or Fraud Alert
Given that Social Security numbers and financial information were stolen, placing a credit freeze with each bureau is one of the strongest protections available. A freeze blocks new creditors from accessing your file, which makes it much harder for criminals to open accounts in your name.
Alternatively, a fraud alert requires lenders to take extra steps to verify your identity before extending credit. Both options are free, and you can lift a freeze temporarily whenever you need to apply for credit yourself.
Enroll in the Offered Identity Protection Services
Central Ohio Primary Care Physicians is providing complimentary credit monitoring, identity theft protection, and dark web monitoring to affected individuals. It is worth signing up for these services as soon as you receive your notification letter.
These tools can alert you quickly if your information appears somewhere it shouldn’t, such as on a criminal marketplace. Because enrollment windows for free services like these are often limited, acting promptly ensures you don’t miss the deadline.
Watch for Healthcare-Related Fraud
Because health information was involved, patients should review statements from their health insurer for any services they do not recognize. This can be an early sign of medical identity theft.
If you notice unfamiliar claims, contact your insurer and the provider listed right away. In addition, requesting a copy of your medical records periodically can help you spot inaccuracies that may have resulted from fraudulent use of your identity.
Stay Alert to Phishing Attempts
Since this breach began with a social engineering attack, affected individuals should be especially cautious of unexpected calls, texts, or emails asking for personal information. Scammers often use breach news to impersonate legitimate organizations.
Never provide personal details to anyone who contacts you unexpectedly, even if they claim to represent Central Ohio Primary Care Physicians or a credit monitoring service. Instead, verify requests independently by calling the organization directly using a number you look up yourself.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.