COPC Data Breach Affects 1.4 Million Patients

Central Ohio Primary Care Physicians Inc. (COPC), a physician-owned medical group with more than 80 practices across central Ohio, disclosed a data breach affecting approximately 1.4 million individuals in the United States, including 709 Massachusetts residents.

On Aug. 25, 2026, COPC discovered it was the victim of a cybersecurity incident resulting from a social engineering, or vishing attack. Through this attack, a criminal threat actor was able to gain unauthorized access to certain files on COPC's systems that contained protected health information.

Upon discovery, security measures were put in place to contain the attack and limit its potential impact on those whose data was stored in the affected files.

COPC noted that its MyChart patient portal, which runs on the Epic system, was not compromised as part of this incident. Patients who use MyChart can continue to log in to their accounts and communicate with their healthcare providers as usual.

The types of information potentially exposed in the breach included both personally identifiable information (PII) and protected health information (PHI) such as first and last name, mailing address, Social Security number, limited health-related patient data (including patient ID number), financial information and other potential identifying information.

COPC began notifying affected consumers on Oct. 16, 2026. The company also posted a notice about the incident on its website.

COPC's response to the breach

COPC is offering free identity theft protection services through IDX, a data breach and recovery services expert. Affected individuals can enroll in these free services by visiting the IDX enrollment page, calling 1-866-200-0918 or scanning the QR code included in their notification letter. The deadline to enroll is Jan. 16, 2027.

IDX representatives are available to answer questions Monday through Friday from 9 a.m. to 9 p.m. Eastern Time, excluding holidays. Individuals who have general questions or concerns about the incident can also reach IDX at 1-866-200-0918.