Patients and employees of Central Ohio Primary Care Physicians may be covered by lawsuits filed after a voice-phishing attack that COPC says exposed Social Security numbers, financial information and health data of about 1.4 million people. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes lawsuits at the complaint stage. Any claims in them are unproven allegations. Central Ohio Primary Care Physicians has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational. It is not legal advice.
What Is This About?
Central Ohio Primary Care Physicians, Inc. (COPC), a Westerville-based physician group with more than 80 locations in central Ohio, said on October 15, 2026 that a criminal used a voice-phishing phone scam to get into files containing protected health information. COPC says its initial investigation found about 1.4 million current and former patients and employees were affected.Within a week of that statement, at least three lawsuits were filed against the company in the U.S. District Court for the Southern District of Ohio: Beekman v. Central Ohio Primary Care Physicians, Inc., No. 2:26-cv-01509, filed October 20, 2026, and Quick v. Central Ohio Primary Care Physicians, Inc., No. 2:26-cv-01520, and Hines v. Central Ohio Primary Care Physicians, Inc., No. 2:26-cv-01521, both filed October 21, 2026, according to the court's dockets. The complaints themselves were not publicly available when this page was published, so their specific claims and proposed class definitions could not be reviewed. COPC has not responded in court.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Breach
According to COPC's statement, the company discovered on August 25, 2026 that it had been hit by a social-engineering attack: a "vishing," or voice-phishing, call carried out in an attempt to get a financial response. Through that attack, COPC says, a criminal gained unauthorized access to certain files containing protected health information. COPC first posted a short notice about a cybersecurity incident on September 4, 2026 and said its practices remained open.COPC says the incident has been contained, that its MyChart (Epic) patient portal was not affected, and that it is not aware of any misuse or attempted misuse of the information for identity theft or fraud. It says it has engaged cybersecurity experts and is working with law enforcement.
The HIPAA Journal reported on October 20, 2026 that a ransomware group called Chaos had listed COPC on its data leak site and threatened to publish stolen data, and that COPC no longer appeared on the site. COPC's own statements do not name the group responsible.
What Information Was Involved
COPC says the exposed files may have included:- First and last names and addresses
- Social Security numbers
- Limited health-related patient data, including patient ID numbers
- Financial information
- Other identifying information
Credit Monitoring Offered
COPC is offering complimentary credit and dark web monitoring through the IDX identity theft protection service. Affected people with contact information on file are being sent letters. People who believe they were affected but did not receive a letter can use the COPC incident page on IDX to request confirmation and a sign-up code. That page lists an enrollment deadline of January 16, 2027.What the Lawsuits Claim
The three federal complaints had not been posted publicly when this page was published. Data breach suits of this kind typically allege that a company failed to adequately protect the personal information it held and seek to represent everyone whose data was exposed, but the specific allegations, legal claims and proposed classes in the COPC cases have not been confirmed. This page will be updated once the complaints are available.What Happens Next
COPC has not yet responded to the suits. When several cases over the same breach are filed in one federal court, they are often consolidated into a single case before the court considers any motion to dismiss. The cases are at the complaint stage, so there is no settlement, no claim form and no deadline for patients or employees.Questions
What happened in the Central Ohio Primary Care data breach?
Central Ohio Primary Care Physicians says it discovered on August 25, 2026 that a criminal had used a voice-phishing (vishing) phone scam to gain unauthorized access to files containing protected health information. COPC says the incident has been contained and that its MyChart patient portal was not affected.
How many people were affected by the Central Ohio Primary Care data breach?
COPC said in its October 15, 2026 statement that its initial investigation found approximately 1.4 million individuals were affected, including current and former patients and employees. It said the full extent of the incident was still under review.
What information was exposed in the COPC breach?
According to COPC, the exposed files may have included first and last names, addresses, Social Security numbers, limited health-related patient data including patient ID numbers, financial information and other identifying information.
Is Central Ohio Primary Care offering credit monitoring?
Yes. COPC is offering complimentary credit and dark web monitoring through IDX. The IDX response site for the incident lists an enrollment deadline of January 16, 2027, and people who believe they were affected but did not get a letter can use that site to request confirmation.
Is there a Central Ohio Primary Care settlement to claim?
No. The lawsuits were filed in October 2026 and are at the complaint stage. There is no settlement, claim form or deadline, and no class has been certified.
Sources
- Central Ohio Primary Care — Cybersecurity Information, company statements dated September 4 and October 15, 2026
- COPC incident response page (IDX), incident FAQ and enrollment deadline
- ABC 6 (WSYX) — "Central Ohio Primary Care says cyberattack may have exposed patient, employee data," October 15, 2026
- The HIPAA Journal — "Central Ohio Primary Care Physicians Data Breach Affects 1.4 Million Patients," October 20, 2026
- Docket, Beekman v. Central Ohio Primary Care Physicians, Inc., No. 2:26-cv-01509 (S.D. Ohio filed October 20, 2026)
- Docket, Quick v. Central Ohio Primary Care Physicians, Inc., No. 2:26-cv-01520 (S.D. Ohio filed October 21, 2026)
- Docket, Hines v. Central Ohio Primary Care Physicians, Inc., No. 2:26-cv-01521 (S.D. Ohio filed October 21, 2026)
