1.4 million patients exposed in Central Ohio Primary Care data breach
Editorial illustration — Press Pass USAThe personal and medical records of 1.4 million current and former patients of Central Ohio Primary Care Physicians were exposed after an unauthorized third party used voice phishing to break into the medical group's internal systems in August 2026.
Central Ohio Primary Care Physicians — known as COPC, an Ohio-based physician-owned primary care medical group — began notifying affected individuals only on or around Oct. 21, more than two months after the breach, according to a notice announced by the law firm AWKO Law LLP on Oct. 22. The firm says that delay may have violated state and federal laws.
The compromised information may include patient names, addresses, Social Security numbers, financial information, health information and other identifying details — a combination that puts affected patients at risk of identity theft and fraud.
"Although the breach occurred in August 2026, COPC did not begin notifying affected individuals until on or around October 21, 2026, which may have violated state and federal laws," the firm's announcement stated. AWKO Law LLP, based in San Francisco, said it is investigating the breach and that affected patients may be entitled to money damages and an injunction requiring changes to COPC's cybersecurity practices.
Patients who received a notification letter — or who believe they are COPC patients — should review the notice carefully, monitor financial and insurance statements, and consider placing fraud alerts on their credit files.
Sources: Business Wire (Oct 22, 2026); Morningstar (Oct 22, 2026).
Sponsored