By Matthew R. Wilson, Esq. and Jared Connors, Esq.
Matthew R. Wilson is a partner at Meyer Wilson Werning, has served as class counsel in numerous nationwide class actions, and chairs the Class Action Committee of the Central Ohio Association for Justice. Jared Connors is recognized by Best Lawyers in Mass Tort Litigation / Class Actions, Plaintiffs, and has worked on numerous consumer class actions, including data breach and privacy cases. Both practice from our Columbus office.
Last reviewed: 10/2026
Meyer Wilson Werning is investigating class action claims on behalf of the roughly 1.4 million patients and employees whose personal information was exposed in the Central Ohio Primary Care Physicians data breach. If you received a notice letter from COPC, or believe your information was involved, contact us. The review is free, and you owe nothing unless we recover for you. Request a free case review or call (614) 756-6637.
What Happened in the COPC Data Breach
On August 25, 2026, Central Ohio Primary Care Physicians discovered that an attacker had gained access to its systems through a “vishing” (voice phishing) attack, a phone call used to trick someone into granting access. COPC, a physician-led group with more than 80 locations across Central Ohio, confirmed that about 1.4 million people were affected. Sources say the ransomware group Chaos was behind the attack.
For our class action team, this case is about more than the numbers. “This breach happened in our backyard. COPC treats patients in nearly every community in Central Ohio, and the people affected are our neighbors. They deserve to know whether their information was protected the way the law requires,” said Matthew Wilson, partner at Meyer Wilson Werning.
The exposed information may include names, addresses, Social Security numbers, financial information, patient ID numbers, and limited health data for both patients and employees. COPC says the incident is contained and MyChart was not affected. It is mailing notice letters, offering free credit and dark web monitoring through IDX, and has opened a call center and a lookup site at response.idx.us/copc.
Who May Be Affected
Our investigation includes current and former COPC patients and COPC employees, whose files can hold Social Security numbers, bank details, and tax forms. If you have not received a letter, you may still be affected, since letters go to the address on file. You can request confirmation at response.idx.us/copc and contact us at the same time.
Our View: This Breach Started With a Phone Call
A vishing attack does not break through a firewall. It talks its way past a person, usually by posing as IT support or a coworker and asking for a password reset or remote access. Defenses are well known and inexpensive. They include verifying callers before resetting credentials, training staff to call back on a known number, and limiting who can reach files with Social Security numbers. Our investigation asks whether those safeguards were in place and followed.
Ohio law makes that question central. Under Ohio’s Data Protection Act (Ohio Revised Code Chapter 1354), a business with a written cybersecurity program that reasonably conforms to a recognized framework, such as the HIPAA Security Rule, can raise an affirmative defense to certain negligence claims after a breach. In Ohio, what matters is what the company’s program required and whether it was followed when the call came in.
We are also examining timing. HIPAA requires notice to patients without unreasonable delay and no later than 60 days after discovery. COPC discovered the breach August 25 and confirmed its scope October 15, and every week of delay is a week people could have frozen their credit.
What to Do Right Now
- Freeze your credit for free with Equifax, Experian, and TransUnion.
- Get an IRS Identity Protection PIN at IRS.gov to block tax fraud using your Social Security number.
- Be suspicious of calls about this breach. Never give personal information to someone who contacts you. Instead, call back using the number on your COPC letter.
- Check your Explanation of Benefits statements for care you did not receive.
- Read before you sign. Enrolling in COPC’s credit monitoring is reasonable, but talk to us before signing anything that releases legal claims.
A Columbus Firm Investigating a Columbus Breach
Meyer Wilson Werning’s main office is on W. Nationwide Blvd. downtown, a short drive from COPC locations across the region. If this matter proceeds, it will likely be litigated in Ohio, under Ohio law, where our class action team has practiced for decades. You can meet with us in person and work directly with the attorneys handling your case.
If you are a current or former COPC patient or employee, contact us for a free, confidential review. You owe nothing unless we recover for you.
See our other active investigations.
COPC Data Breach FAQ
Has a lawsuit been filed?
Yes. On October 16, 2026, Meyer Wilson Werning filed a class action lawsuit against Central Ohio Primary Care Physicians in the Franklin County Court of Common Pleas: Steele v. Central Ohio Primary Care Physicians, Inc., Case No. 26CV009670. The proposed class includes every person in Ohio whose personal information was exposed in the breach. The allegations have not been proven. If you were affected, contact us to learn how the case may apply to you.
I didn’t get a letter. Can I still have a claim?
Possibly. Letters go to the address on file, which may be outdated. Contact us either way.
COPC says there’s no evidence my information was misused. Does that matter?
A Social Security number can’t be changed like a password, and fraud often appears long after a breach. A claim may also cover time and money spent protecting yourself.
How long do I have to act?
Deadlines vary by claim and can be shorter than expected. The sooner you reach out, the more options you keep.