COLUMBUS, Ohio, Oct. 16, 2026 (GLOBE NEWSWIRE) — Edelson Lechtzin LLP, a national class action law firm, is investigating data privacy claims arising from the Central Ohio Primary Care (COPC) data breach. On October 15, 2026, COPC confirmed that a cybersecurity incident discovered on August 25, 2026, may have exposed the personal information of approximately 1.4 million patients and employees — a figure far larger than early reporting suggested.
Key Facts at a Glance
- Organization affected: Central Ohio Primary Care Physicians Inc. (COPC), a physician-owned primary care group in Ohio
- People impacted: Approximately 1.4 million patients and employees
- When: Incident discovered on or about August 25, 2026; COPC issued a public update on October 15, 2026
- Cause: A “vishing” (voice phishing) attack carried out for financial gain, through which a hacker accessed files containing protected health information
- Data potentially exposed: Names, addresses, Social Security numbers, patient ID numbers, financial information, and limited health-related data
- Not affected: COPC’s MyChart patient portal
- Who is investigating: Edelson Lechtzin LLP, a national class action law firm
What Happened in the COPC Data Breach?
COPC has stated that the incident resulted from a vishing attack — a social-engineering scheme using fraudulent phone calls — carried out in an attempt to obtain money. Through the attack, an unauthorized actor accessed files containing protected health information. COPC’s investigation determined that roughly 1.4 million people were affected.
Earlier third-party reporting from cybersecurity monitoring sources linked the ransomware group Chaos to an August attack and estimated that the attackers exfiltrated between 263 and 362 gigabytes of data. COPC’s October 15 update did not confirm those earlier attributions. The firm’s investigation is ongoing.
What Information May Have Been Exposed?
According to COPC, the potentially exposed information may include first and last names, addresses, Social Security numbers, patient ID numbers, financial information, limited health-related data, and other identifying information. COPC has said there has been no reported misuse of personal information for identity theft or fraud stemming from the incident.
What Is COPC Doing?
COPC says it has contained the incident and is working with authorities and cybersecurity professionals to reinforce its security and help prevent future incidents. COPC is offering complimentary credit and dark web monitoring to anyone whose information may have been exposed. Affected individuals will receive written notification by mail. Others who believe they may be affected can visit https://response.idx.us/copc for more information.
What Are My Legal Options?
Edelson Lechtzin LLP is investigating a potential class action on behalf of individuals whose sensitive data may have been compromised. A successful class action could allow affected patients and employees to recover compensation for harms such as loss of privacy, lost time, and out-of-pocket costs, and could push COPC to strengthen how it protects the information entrusted to it. The firm evaluates your rights and potential claims at no cost.
Contact Us for a Free Case Evaluation
Speak confidentially with a data privacy attorney today:
Marc Edelson, Esq. | Edelson Lechtzin LLP 411 S. State Street, Suite N-300, Newtown, PA 18940 | Phone: 844-696-7492 | Email: medelson@edelson-law.com | or click HERE to request a free consultation.
About Edelson Lechtzin LLP
Edelson Lechtzin LLP is a national class action law firm with offices in Pennsylvania and California. In addition to data breach litigation, the firm handles class and collective actions involving securities and investment fraud, federal antitrust violations, ERISA employee benefit plans, wage theft, and consumer fraud.
Legal Notice: This press release may be considered Attorney Advertising in some jurisdictions.
Media gallery
