Central Ohio Primary Care Physicians breach exposes 1.4 million patients' data after vishing attack; Chaos ransomware listing
Central Ohio Primary Care Physicians, a large physician-owned primary care group based in Westerville, Ohio, with more than 80 locations, disclosed a breach affecting about 1.4 million current and former patients. In August 2026, an unauthorized third party used a voice phishing (vishing) attack to obtain credentials that gave access to internal systems. The access was detected and blocked on August 25, 2026. The threat group was not named in the breach notices, but the incident appears to be the work of the Chaos ransomware group, which listed the victim on its dark web leak site and threatened to publish the data. The listing has since been removed.
Technical Details
- Initial access was through vishing that yielded valid credentials for internal systems.
- Investigators confirmed that files containing patient data were exfiltrated.
- The exposed data includes names, addresses, Social Security numbers, financial information, health information and other identifying information.
- Chaos claimed that no contact had been made with the victim when it posted the listing. The listing was later removed, and the article does not say why.
- The organization reported no detected misuse of the data at the time notification letters were issued.
Remediation
- Notification letters are being mailed to affected individuals.
- The organization is offering complimentary credit monitoring, identity theft protection and dark web monitoring.
- The organization says it has enhanced its security, but gives no specifics.
- Defenders should train help desk and staff to resist vishing and enforce phishing-resistant MFA and caller verification for credential and access requests.
Linha do tempo
-
Central Ohio Primary Care Physicians breach exposes 1.4 million patients' data after vishing attack; Chaos ransomware listing
ler a análise desta fonte ocultar
Central Ohio Primary Care Physicians, a large physician-owned primary care group based in Westerville, Ohio, with more than 80 locations, disclosed a breach affecting about 1.4 million current and former patients. In August 2026, an unauthorized third party used a voice phishing (vishing) attack to obtain credentials that gave access to internal systems. The access was detected and blocked on August 25, 2026. The threat group was not named in the breach notices, but the incident appears to be the work of the Chaos ransomware group, which listed the victim on its dark web leak site and threatened to publish the data. The listing has since been removed.
Technical Details
- Initial access was through vishing that yielded valid credentials for internal systems.
- Investigators confirmed that files containing patient data were exfiltrated.
- The exposed data includes names, addresses, Social Security numbers, financial information, health information and other identifying information.
- Chaos claimed that no contact had been made with the victim when it posted the listing. The listing was later removed, and the article does not say why.
- The organization reported no detected misuse of the data at the time notification letters were issued.
Remediation
- Notification letters are being mailed to affected individuals.
- The organization is offering complimentary credit monitoring, identity theft protection and dark web monitoring.
- The organization says it has enhanced its security, but gives no specifics.
- Defenders should train help desk and staff to resist vishing and enforce phishing-resistant MFA and caller verification for credential and access requests.