If you are a patient or employee of Central Ohio Primary Care (COPC), assume your name, address, Social Security number and financial details are exposed. COPC says 1.4 million people were affected. Freeze your credit at all three bureaus, enroll in the free IDX monitoring COPC is offering, and treat any call claiming to be COPC as a possible scam.
What Happened in the Central Ohio Primary Care Breach
Central Ohio Primary Care Physicians, one of the largest physician-owned primary care groups in the country with dozens of practices around Columbus, says it discovered a cyberattack on August 25, 2026. According to COPC, the attack began with a voice phishing (vishing) call: a caller used social engineering to talk their way into access to files containing protected health information.
The day after the attack, the ransomware group Chaos listed COPC on its dark web leak site, according to threat-intelligence reporting, with claims of roughly 263–362 GB of stolen data. COPC itself has not publicly named the group, and the data-volume figures have not been independently verified.
In October 2026, COPC released its initial assessment: approximately 1.4 million patients and employees were affected. That is far more than the practice's estimate of active patients, which suggests former patients and staff are included. COPC says its investigation is ongoing and that it is not aware of any misuse of the information for identity theft or fraud so far.
What Data Was Exposed
COPC says the compromised files included:
- Full names and home addresses
- Social Security numbers
- Financial information
- Limited health information, including patient ID numbers
- Other identifying details
Why This Combination Is Dangerous
A Social Security number plus a home address is enough to open new credit in your name, file a fraudulent tax return or apply for benefits. Adding patient IDs and health details makes convincing medical-billing and insurance scams possible. Unlike a password, you cannot change your SSN, so the protective steps below matter for years, not weeks.
How to Know If You Were Affected
COPC is mailing written notification letters to affected people at the address it has on file. If you were a COPC patient or employee and have moved, your letter may never reach you. COPC has set up a dedicated call center and an IDX response page at response.idx.us/copc, where you can confirm whether you were impacted and get an enrollment code for the free protection.
COPC also says patients can continue to use MyChart safely. Do not click links in emails or texts that claim to be about the breach — go to the IDX page or call the number printed in your letter directly.
Is your data already out there?
Leaked data ends up on broker sites and in scammers' hands. Run a free 60-second scan to see your exposure — then let us remove it.
Run a free scan★★★★★ 4.8/5 · Trusted by thousands of families
What to Do Right Now
Step 1: Freeze your credit at Equifax, Experian and TransUnion
A credit freeze is free and is the single most effective defense against new-account fraud using a stolen SSN. It takes about 15 minutes online, and you can temporarily lift it when you need to apply for credit. Our guide on freezing your credit at all three bureaus walks through each site.
Step 2: Enroll in the free IDX monitoring
COPC is offering free credit and dark web monitoring through IDX. Use the code from your letter or the response page. Monitoring will not prevent fraud on its own, but it alerts you quickly if someone uses your identity. If you are weighing whether to keep paying for it after the free period, read our review of IDX credit monitoring.
Step 3: Get an IRS Identity Protection PIN
Because SSNs were exposed, request an IP PIN at irs.gov/ippin. It blocks anyone else from filing a federal tax return using your SSN — one of the most common ways stolen SSNs are monetized.
Step 4: Watch your medical statements
Review every Explanation of Benefits from your health insurer for visits, prescriptions or equipment you never received. Medical identity theft is slow to surface and can corrupt your health record. Our guide to protecting yourself from medical identity theft covers what to look for and how to dispute it.
Step 5: Treat calls about the breach as suspicious
This breach started with a phone call, and criminals holding breach data routinely call victims pretending to be the provider, an insurer or a "breach settlement" office. COPC will not call you to ask for your SSN, card number or a one-time code. Hang up and call back on a number you look up yourself. Learn the warning signs of AI-powered vishing attacks.
Step 6: Remove your address and phone number from data brokers
Scammers enrich stolen records with data from people-search sites to find your current phone number, relatives and new address. Removing yourself from those sites cuts off the easiest way to turn a breach record into a targeted scam. You can do it manually or use one of the best data removal services to handle it continuously.
Should You Join a Class Action?
Several law firms, including Edelson Lechtzin LLP, have opened investigations into the COPC breach. Joining a class action costs nothing, but settlements take years and typically pay small amounts. Protect yourself now rather than waiting on a lawsuit.
For a broader checklist that applies to any healthcare incident, see what to do after a medical data breach.
Frequently Asked Questions
How many people were affected by the Central Ohio Primary Care data breach?
COPC's initial assessment puts the number at about 1.4 million patients and employees. The practice says the investigation is ongoing, so the final count could change as notification letters go out.
Was my Social Security number exposed in the COPC breach?
COPC says the affected files included names, addresses, Social Security numbers, financial information and limited health data. Not every person necessarily had every field exposed — your notification letter or the IDX response page at response.idx.us/copc will tell you what applies to you.
Is COPC offering free credit monitoring?
Yes. COPC is providing free credit and dark web monitoring through IDX. Enroll using the code in your letter, or check response.idx.us/copc if you think you were affected but have not received a letter.
Is it safe to keep using COPC and MyChart?
COPC says patients can safely continue using MyChart. As a precaution, change your MyChart password if you reused it anywhere else, turn on two-factor authentication, and never share login codes with anyone who calls you.
Who was behind the Central Ohio Primary Care cyberattack?
The ransomware group Chaos listed COPC on its leak site the day after the attack, according to threat-intelligence reporting. COPC has said only that a voice phishing scam gave attackers access and has not publicly named the group.
What is the best way to protect myself long term after this breach?
Keep your credit frozen, keep an IRS IP PIN, and reduce how much of your information is publicly available. PrivacyOn removes your personal data from 100+ data brokers and people-search sites, monitors the dark web for your details, and covers families of up to 5 people from $8.33/month.
Protect Yourself Beyond This Breach
A breach like COPC's is only as damaging as the extra data criminals can find about you afterward. PrivacyOn continuously removes your address, phone number and relatives from 100+ data brokers, alerts you when your information appears on the dark web, and keeps re-checking so listings do not come back. Run a free PrivacyOn scan today to see where your information is exposed right now.