A scam phone call gave hackers a way into Central Ohio Primary Care Physicians, exposing Social Security numbers and health data for 1.4 million patients.
A phone call is how attackers got into one of the largest independent primary care groups in the country. Central Ohio Primary Care Physicians says about 1.4 million current and former patients had personal and health information taken. The group is based in Westerville, Ohio, and has more than 80 locations in Central Ohio.
In August 2026, the group was hit by what is called vishing, short for voice phishing. That is a scam call where the caller tricks someone into handing over login details. The attackers used the credentials they got to reach internal systems. The group says it detected and blocked the access on August 25, 2026.
Files were copied out of the systems. After review, the group found they held names, addresses, Social Security numbers, financial information, health information and other identifying details. That mix is what makes this breach serious. It is the kind of data that can be used for identity theft.
The breach notices do not name who did it. The attack appears to be the work of a ransomware group called Chaos. Ransomware gangs steal data and then demand money, threatening to publish it if they are not paid. Chaos listed the medical group on its dark web leak site. It claimed no contact had been made at the time. The listing has since been removed. No reason for that has been given.
Current and former patients of the group are the people directly affected. Letters are being mailed. The group is offering free credit monitoring, identity theft protection and dark web monitoring. It says it had not found any misuse of patient information when the letters went out. If you never visited this group, your records are not part of this breach.
The lesson reaches further than Ohio. Any clinic, home-care agency or small office with staff who answer phones and use logins can be targeted the same way. The steps in the alert box above cover what to put in place.
Several things are still unknown. The group has not said how many staff were fooled, how long the attackers had access before August 25, or whether anything was paid. The group says it has strengthened its security.
Patients who get a letter should read it, sign up for the free services and watch bank and credit statements for anything unfamiliar. Be wary of calls or messages that mention your medical group, since stolen details can make a scam sound real.
Never give a password or code to anyone who calls you. Hang up and call back on a number you already know.
A message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone number
