Central Ohio Primary Care Physicians, Inc. disclosed an August 2026 cybersecurity incident after an unauthorized actor gained access to internal systems containing sensitive files. The physician-owned medical group discovered the unauthorized activity on August 25, 2026, following a social-engineering vishing attack. The organization contained the incident and began mailing formal notice letters to impacted individuals in mid-October 2026.
An investigation confirmed that the compromised files contained personal information for approximately 1.4 million patients and employees nationwide, including at least 709 residents in Massachusetts. Exposed records included names, mailing addresses, Social Security numbers, financial information, patient identification numbers, and limited protected health information. The group stated that its MyChart patient portal hosted through Epic was not compromised during the attack.
Additional details regarding regulatory inquiries and state-by-state impact figures may continue to emerge as state authorities process filings. The organization stated it has not found evidence showing unauthorized access beyond the contained incident.