Central Ohio Primary Care Physicians Data Breach Affects 1.4 Million Patients
Central Ohio Primary Care Physicians, one of the largest independent physician-owned primary care medical groups in the United States, has experienced a cybersecurity incident that involved the personal and protected health information of approximately 1.4 million current and former patients, according to local media reports.
The Westerville, Ohio-based medical group, which has more than 80 locations in Central Ohio, experienced a voice phishing (vishing) attack in August 2026 that resulted in unauthorized third-party obtaining credentials that provided access to internal systems. The unauthorized access was detected and blocked on August 25, 2026.
The investigation into the incident confirmed that files containing patient information were exfiltrated in the incident. The files have now been reviewed and found to contain patient names, addresses, Social Security numbers, financial information, health information, and other identifying information.
Notification letters are being mailed to the affected individuals, and complimentary credit monitoring, identity theft protection, and dark web monitoring services are being made available. Central Ohio Primary Care Physicians said it has not detected any misuse of patient information as a result of the incident at the time of issuing notification letters. Central Ohio Primary Care Physicians said it takes data privacy and security seriously and had implemented appropriate security measures prior to the incident. Security has since been enhanced to reduce the risk of similar incidents in the future.
The threat group behind the attack was not disclosed in the breach notices; however, it appears to be a ransomware group called Chaos. The group added Central Ohio Primary Care Physicians to its dark web data leak site and threatened to publish the stolen data if payment was not made. The group claimed that contact had not been made at the time of the listing, but Central Ohio Primary Care Physicians is no longer listed on the site.
