A Phone Call Breached 1.4 Million Health Records. It Was Not Even a Sophisticated Hack.

On Oct. 15, 2026, Central Ohio Primary Care (COPC), one of the largest primary care organizations in the United States, confirmed that a cyberattack in August compromised the protected health information and personal data of more than 1.4 million current and former patients and employees. The entry point was not a zero-day exploit, a misconfigured server, or a malicious email attachment. It was a vishing attack: voice phishing, carried out over the phone, aimed at extorting money from the organization.

The disclosure matters less for the technical details, which COPC has declined to fully share, and more for what it reveals about where major breaches now begin. Enterprise security teams have spent years hardening email, endpoints, and cloud accounts. The COPC incident suggests the phone line is the door they left unlocked.

What happened

COPC said it discovered the incident on Aug. 25. Through the vishing attack, a threat actor gained unauthorized access to files containing protected health information, according to its press release. Roughly 51 days passed before the practice publicly announced what happened on Oct. 15, a delay of about a month and a half.

The data potentially exposed reads like an identity theft starter kit: names, addresses, Social Security numbers, "limited" patient health data, financial information, and patient ID numbers. COPC said not every impacted individual had every one of these data points exposed.

COPC declined to describe how the vishing attack unfolded or who the attacker was impersonating, but it confirmed the scam "was not directed at patients." The scale is what stands out. COPC is a large, physician-owned medical group serving more than 500,000 patients across Ohio. A single voice-based social engineering incident expanded into the exposure of records for 1.4 million people, current and former patients plus employees.

The most expensive firewall in the world does not help when the attacker simply calls someone who can open the door.

Who is behind it

COPC has not named the attacker. But reporting from the dark-web security blog HookPhish and the cybersecurity site Breachsense says the ransomware group Chaos has claimed responsibility, and several class-action law firms investigating the breach are pointing to the same group. Chaos has been active since early 2025 and has become known for Microsoft Teams vishing attacks, a tactic that pairs voice-based social engineering with modern collaboration tools.

Breachsense reported that the attackers acquired approximately 362 gigabytes of data; earlier reporting cited a figure of roughly 263 GB. Those figures are claims from third-party reporting and remain unconfirmed; COPC has not verified the volume or contents of what was taken.

The vishing problem

Vishing, short for voice phishing, is social engineering over the phone. An attacker impersonates a trusted figure, a human resources staffer, a government official, a fellow employee, or a vendor, and talks the target into handing over credentials, approving an action, or granting access. Some attackers now use AI to mimic specific voices, making the impersonation harder to spot.

Unlike phishing emails, vishing does not leave an easily inspected artifact. There is no link to hover over, no attachment to scan. A phone call is ephemeral, and it exploits a channel, the human voice, that people are culturally wired to trust. When the person on the other end sounds authoritative and urgent, the normal verification reflexes that work for email tend to shut down.

That is what makes the COPC case a useful warning for other organizations. The group was not breached through its patient portal. COPC stressed that its MyChart portal was not impacted and that patients can keep logging in as usual. The attackers went around the hardened digital perimeter entirely and came in through the phones.

The response, and what comes next

After discovering the attack, COPC said it began working with authorities and cybersecurity professionals to assess exposure, reinforce security measures, and prevent future incidents. CEO Dr. Don Deep said the organization is implementing enhanced security protocols to protect its systems and the people who trust it with their personal information. COPC said it is unaware of any misuse or attempted misuse of the breached data so far, and it continues to work with law enforcement on the investigation.

For those potentially affected, COPC is offering free credit and dark web monitoring. Impacted individuals with contact information on file will receive written notification. Anyone who believes they were impacted and does not receive a letter can check their status and enroll in monitoring at response.idx.us/copc, and a dedicated call center (866-200-0918) is available weekdays from 9 a.m. to 9 p.m. Eastern.

COPC also warned patients to watch for follow-on scams. Attackers routinely exploit breach publicity with fake messages posing as the victim organization, and COPC urged anyone receiving a suspicious message claiming to be from the practice to contact their office directly rather than clicking links or sharing personal information.

The incident is also likely to play out in courtrooms. Law firms, including Edelson Lechtzin LLP, have launched investigations into the breach and are evaluating class actions; in similar cases these have sought compensation for lost privacy, lost time, and out-of-pocket costs.

Why this matters

Healthcare data remains one of the most attractive targets in cybercrime because a single medical record bundles a name, a Social Security number, financial details, and health history into one package, and that combination stays valuable to criminals for years. COPC is now one of the larger healthcare breaches of 2026 by headcount.

The 51-day gap between discovery and disclosure is worth watching but is not unusual. Breach notification rules, including federal healthcare rules, generally require organizations to notify affected individuals within a set window after discovery, and investigations of this size, determining whose records were touched across 1.4 million people, take time. What matters going forward is whether attackers are already monetizing the data while patients wait for their letters.

The bigger lesson is structural. Security budgets have followed the attack surface into cloud and email, while voice channels have received comparatively little investment: no phishing-aware caller verification, no standardized protocol for confirming that a caller is who they claim to be, and often no training beyond a slide in an onboarding deck. Ransomware groups have noticed. The vishing playbook that Chaos is reportedly associated with turns the cheapest attack channel into the most reliable one. Until defending the phone gets the same rigor as defending the inbox, incidents like this one will keep repeating.