A vishing crew's foothold at an Ohio physician group became the second-largest patient breach disclosed this month, and the 1.4 million figure surfaced only after local reporters pressed the organization.
Central Ohio Primary Care Physicians runs more than 80 locations out of Westerville, one of the country's biggest physician-owned primary care groups. Its timeline puts the intrusion in August 2026: a voice phishing call handed an outside party working credentials, and access was blocked August 25. Confirmation of the patient count landed October 15.
The review found the standard ransomware shopping list: names, addresses, Social Security numbers, financial details, health records, and other identifiers in files the intruders pulled out. Notification letters and credit monitoring are going out now.
Nobody has formally named an attacker. The Chaos ransomware operation listed the group with a publication countdown, then pulled the listing. MedRisk covered that August 30 claim at 500,000 patients; the October figure nearly triples it.
Why the delay matters
Five weeks passed between the blocked intrusion and confirmation. HIPAA's breach rule gives covered entities 60 days from discovery, so the group is inside the window, barely.
The mechanics are the familiar weak point. Vishing defeats multi-factor authentication by convincing a human to approve a prompt or read back a code, so no patch closes it. Help desks need to know that a caller claiming to be IT will never ask for a code.
What peers should do
Pull phone-verified identity resets for every account with patient-file access, and check for MFA prompts pushed without a matching user action. Watch for identity-provider logins from new geographies on credentials that answered a support call.
Central Ohio is not the first this year. Quantum Health and a Texas group of 16,885 patients both traced breaches to vishing.
