Roughly 1.4 million patients and employees at Central Ohio Primary Care Physicians faced exposed health and identity data after a single voice call produced credentials for internal systems. According to COPC’s official cybersecurity notice, a social-engineering vishing attack seeking a financial response let a criminal threat actor reach files holding protected health information. Preventing that outcome means removing every transferable secret a caller can coach someone to speak, type, approve, or reset before workforce login succeeds.
What the COPC vishing call unlocked
According to COPC’s updated notice published October 15, 2026, the organization discovered the incident on August 25, 2026. The notice states the event “resulted from a social-engineering, or ‘vishing’ (voice phishing), attack, carried out in an attempt to solicit a financial response.” Through that attack, a threat actor gained unauthorized access to certain files containing protected health information.
Intake and public materials describe the operational result as credentials used for internal system access. COPC reported the incident was contained, with no further unauthorized access observed after discovery. MyChart (Epic) was not impacted, and patients could continue normal portal login. COPC also stated it is unaware of any misuse or attempted misuse of personal information for identity theft or fraud stemming from the incident. Complimentary IDX credit and dark-web monitoring were offered, with a dedicated call center at 1-866-200-0918.
Exposed material, per the notice, can include names, addresses, Social Security numbers, limited health data, patient identifiers, financial information, and other identifiers covering patients and employees. Third-party reporting has listed Chaos in connection with the case. COPC’s own notice does not name that group, so treat the attribution as unconfirmed by the victim disclosure. No ransom demand or payment figure appears in the official materials.
If you want more detailed information about this attack, read the related post on legacymfa.sucks: how COPC vishing produced credentials for PHI file access.
Why transferable factors lose to a live coach
Vishing of this class is live coaching under pressure, not a novel exploit string. Someone on the line is talked into handing over proof that still works when a stranger replays it. Passwords spoken aloud, one-time codes read from a handset, recovery secrets shared “with IT,” and push approvals granted while a caller walks through a fake ticket all sit in the same family. Each is a transferable factor. The caller does not need to break cryptography if the victim (or support staff) will move the secret for them.
COPC’s disclosure does not name which MFA method, if any, sat on the path that failed. It does not document a helpdesk reset, temporary access pass, SMS relay, push-fatigue campaign, or adversary-in-the-middle proxy. Those techniques show up in other workforce cases. They are not established here. What is established is verbal social engineering under a financial pretext, then authenticated reach into internal files.
Any factor a caller can coach fails the same way, whichever one COPC used. Knowledge and possession factors remain coachable when the proof can leave the rightful holder’s control. A password typed while a caller listens is still a password. An OTP read over the phone is still an OTP. An approval granted because the voice on the line sounds urgent is still an approval. Whatever sat behind COPC’s internal login, something transferable left the organization and opened the door.
Once those credentials worked, the attacker did not need a second dramatic exploit to reach the PHI store. Authenticated access to internal systems is enough when the files sit behind that login. Containment after discovery limits dwell time. It does not rewrite how the first session was obtained. Files read inside an already-authenticated session are not undone by a stronger second factor on the next login attempt.
Patient-portal controls did not decide this incident. MyChart stayed available and unaffected. The population at risk scaled with clinical and employee records behind the workforce path the caller unlocked, not with one-by-one takeover of every patient account. Healthcare identity failures scale by the size of the population behind the workforce door.
| Control surface | Public record | Failure under voice pressure |
|---|---|---|
| Voice channel | Financial-solicitation vishing | Secrets can be coached live |
| Workforce login | Credentials used internally | Factor type not disclosed |
| Patient portal | MyChart not impacted | Portal was not the entry path |
| File store | PHI and identifiers accessed | Successful authn unlocked files |
What device-bound MFA 2.0 removes from the call
Device-bound, phishing-proof workforce authentication changes the economics of the call. There is no password to dictate, no OTP to read, no push to approve, and no recovery secret support can speak aloud. Authentication is a hardware-bound private key that signs a challenge for the real origin. The private key never leaves the device, never crosses the phone line, and never becomes something a stranger can type on another endpoint.
On a coached fake page or a live verbal walkthrough, the attacker has the wrong origin and no transferable factor to complete. Adding a new device requires an already-enrolled device, not a phishable enrollment code delivered by voice. The prevention-focused design is the point: the attack cannot finish at login because the proof the caller needs does not exist in a form a human can hand over.
COPC’s public materials show credentials handed over during a vishing call, then file access. Closing transferable secrets at workforce login is where prevention sits. MFA 2.0 would have blocked the path where a caller obtains a usable internal login secret. It would not roll back files already read inside a session that had already succeeded. That residual problem is endpoint compromise or post-auth containment, a different and harder bar than talking someone through a phone script.
Short session lifetimes and revoke tools matter after a token already exists. They are cleanup. They are not a substitute for removing the phishable login surface that made the first session cheap to obtain. When the breach path is verbal credential transfer, the decisive control is upstream: the call never produces a password, code, or approval that unlocks internal systems.
Healthcare defenders should also separate workforce identity from patient-facing portals. Hardening MyChart alone would not have closed the internal file path COPC described. The login that mattered was the employee, contractor, or staff path that reached the PHI store. Treat that path as a first-class identity surface with the same non-transferable bar you would demand for privileged admin access.
Passkeys and FIDO2 for this login path
Passkeys and FIDO2 put an asymmetric key pair on the user’s device. The private key stays in hardware. The server holds only a public key. Each login is an origin-bound signature, not a reusable secret typed into a form. Industry language correctly calls that phishing-resistant at the authentication ceremony: a reverse-proxy kit cannot relay a signature meant for the real enterprise IdP host to a lookalike page.
With an enterprise identity provider that issues only hardware-bound signatures, the user proves presence on an enrolled device. Nothing useful is spoken to a caller. That hardens the login act itself against remote completion of a fake ceremony.
Closing enrollment and recovery loopholes
Phishing-resistant login is still weaker than full-lifecycle phishing-proof coverage when enrollment or recovery reintroduces a phishable factor. If a new device can be onboarded with an email code, SMS OTP, or helpdesk-read secret, a coached caller can aim at registration instead of the daily login. COPC’s notice does not establish that recovery or re-enrollment was the path used. The principle still matters for healthcare workforce identity: any stage that reintroduces a transferable secret recreates the surface voice social engineering needs.
MFA 2.0 is phishing-proof because no phishable factor appears at registration, device onboarding, authorisation, authentication, or decommissioning. Enrolment policy that demands an already-enrolled device closes the same pressure support teams feel when a confident caller demands a reset. Resistant hardens the login act. Proof closes the lifecycle.
Key Takeaways for Defenders
- Treat financial-solicitation vishing as a workforce identity attack, not only a billing or fraud problem.
- Remove passwords, OTPs, SMS codes, and push approvals from internal clinical and admin login paths.
- Require an already-enrolled device for any new-device onboarding; forbid phone-read recovery secrets.
- Keep patient-portal hardening separate from workforce IdP controls that guard PHI file stores.
- Plan revoke and endpoint response for post-auth sessions, without pretending they replace prevention at login.
The organizations that stop the next COPC-style event will not train staff to “spot better scripts.” They will stop issuing secrets a script can harvest.
FAQ
Would phishing-proof MFA have stopped the COPC vishing credential handover?
Phishing-proof, device-bound workforce MFA would have blocked the transferable-secret surface a vishing caller needs to obtain internal login credentials like those used after COPC’s financial-solicitation call. According to COPC’s official notice, the incident produced unauthorized access to files holding protected health information after that social-engineering attack. COPC has not named the MFA method on the compromised path, so no specific product can be declared bypassed. Removing secrets a person can speak, type, approve, or reset under live coaching is what closes this attack class at login. Once a session already exists and files are read, login MFA does not undo that access.
Why didn’t MyChart protections decide the COPC incident?
MyChart protections did not decide the COPC incident because the patient portal was not the entry path. According to COPC’s official cybersecurity notice, MyChart (Epic) was not impacted, and patients could continue normal portal login. The unauthorized access reached certain internal files containing protected health information after workforce credentials obtained through vishing worked on internal systems. Hardening only the consumer-facing portal leaves the employee and staff identity path that guards clinical file stores exposed.
How is MFA 2.0 different from passkeys for healthcare vishing?
Passkeys and FIDO2 are phishing-resistant at the login ceremony: origin-bound signatures stop remote relay of the authentication act. MFA 2.0 is phishing-proof across the identity lifecycle, so registration, device onboarding, recovery, and authentication never reintroduce a phishable OTP, SMS code, push, or helpdesk-read secret. For COPC-style healthcare vishing, that full-lifecycle bar matters because callers can pressure either the user at login or support during recovery. Public COPC materials do not prove which stage failed; both stages remain coachable when transferable factors exist.
What should healthcare CISOs change first after a COPC-like notice?
Healthcare CISOs should first eliminate transferable workforce factors on every path that can reach PHI file stores, EHR admin tools, and shared clinical drives. Require hardware-bound signatures for staff and contractor login, forbid voice-delivered recovery secrets, and demand an already-enrolled device before any new authenticator is trusted. Pair that with explicit session revoke playbooks for the residual case where malware steals a cookie after a legitimate sign-in. Prevention at authentication is cheaper than monitoring 1.4 million people after the fact, the scale COPC’s initial investigation described.
Does Chaos ransomware attribution change the MFA lesson for COPC?
Chaos ransomware attribution does not change the MFA lesson for COPC because the official notice does not name Chaos or any other group. Third-party listings have associated Chaos with the incident; treat that claim as unconfirmed by the victim disclosure until COPC or a regulator says otherwise. No ransom demand or payment amount appears in COPC’s published materials. The authentication lesson stays tied to documented facts: vishing produced credentials used for internal access to PHI files, and non-transferable workforce authentication is what removes that handover surface.
