The whole point of symmetric encryption is that if an attacker doesn't have the key, they can't decrypt the data. AES has no publicly-known computationally feasible attacks (significantly better than brute-forcing the entire 2128 key space) on it that are relevant to this scenario.
If the data is at rest, there's no chosen plaintext attack -- there's no system that accepts chosen plaintext and encrypts it. You can only do the chosen plaintext attack if an attacker can submit arbitrary plaintexts to a system that will encrypt them and spit back the ciphertext.
Now if you expanded the attack surface to one where an attacker could request a plaintext be encrypted with an unknown key, then there is a potential chosen plaintext attack if the IV is reused or known to the attacker prior to submitting their plaintext.
With the expanded attack surface, then if (1) the IV was fixed or known to the attacker prior to submitting the plaintext, and (2) an attacker could convince your system (that has the key) to encrypt arbitrary text submitted by them, and (3) the message space for each block is fairly small (only say a few thousand/million/billion possibilities which is significantly smaller than the full 2128 options allowed with 16 arbitrary bytes) for each 16-byte block of plaintext), then yes attacker efficiently could submit arbitrary plaintext with the same fixed IV (or account for the changing IV when making their plaintext guess) until they found a match to each block of the ciphertext they wish to decrypt. They could do this block by block (an AES block is 128-bits = 16 bytes) to sequentially guess the original plaintext by brute-force (of the small message space).
However with a random 128-bit IV not known ahead of time, this attack would not work. Why? Because in CBC mode
c = E(k, p XOR IV),
c[i] = E(k, p[i] XOR c[i-1]) for i > 0 and the IV changes every time (and is unknown when you submit the plaintext, so you can't account for the change in IV and your change in your guess of p).
How do you protect the data in this case?
The data is already protected.