Amplifon Hearing Health Care, the US arm of Italian hearing care company Amplifon, has disclosed that attackers broke into its internal systems and stole files containing personal, health and insurance data. For some people, the stolen files also held Social Security numbers and financial information. The company's filing with the Texas Attorney General puts the total at 1,332,826 people nationwide, including 85,804 Texas residents. A separate filing with the Vermont Attorney General lists 1,027 Vermont residents. The intrusion ran from January 18 to February 8, 2026, but people are only being notified now, almost nine months after it began. No threat actor has claimed the attack, and Amplifon has not said how the attackers got in.
What Happened
The company that reported the breach is Amplifon (USA), Inc., also called Amplifon Americas. It is based in Minneapolis and is the US subsidiary of Milan-based Amplifon S.p.A. In the US it runs hearing care benefit programs for health plans and employers, as well as retail hearing care networks. SecurityWeek reports that the company says it serves more than 80 million members through thousands of clinics across the country.
According to Amplifon's data breach notice, an unauthorized party got into its internal systems and copied files from certain systems between January 18 and February 8, 2026. The company says it contained the incident, brought in outside cybersecurity experts and started an investigation. On October 6, 2026, it concluded that personal information may have been affected.
Amplifon notified the Vermont Attorney General on November 5, 2026, and the Texas Attorney General on November 6. It is sending letters to affected people by US mail and has posted a notice on its website.
Accounts differ on when Amplifon actually found the intrusion:
- Amplifon's own website notice, as reported by ClassAction.org, says the company spotted suspicious activity on February 11, 2026, three days after the copying stopped. SecurityWeek likewise reports that Amplifon contained the incident right away and then spent about eight months reviewing the stolen data.
- The Texas Attorney General filing lists October 6, 2026 as the discovery date, according to law firm Emery Reddy. On that basis, Emery Reddy describes the breach as having gone undetected for about eight months.
The most likely explanation is that the Texas form records the date Amplifon confirmed personal data was involved, not the date it first detected the attackers. Amplifon has not cleared this up publicly. Either way, people whose data was taken in February went roughly nine months without being told.
What Was Taken
Amplifon's notice and the state filings list the following data:
- Names, contact information and postal addresses
- Dates of birth
- Driver's license numbers, state ID numbers and other government-issued ID numbers
- Hearing and medical information, medical record numbers and dates of service
- Other health information
- Health insurance ID numbers and other insurance information
- Social Security numbers and financial information, for a smaller group of people
SecurityWeek reports that Amplifon says Social Security numbers and financial data were taken for "some individuals." Law firm Abington Cole + Ellery describes this group as "a limited number of individuals." The Texas and Vermont filings both list Social Security numbers among the data involved. Neither Amplifon nor the regulators have said how many of the 1.3 million people had their Social Security numbers exposed.
Every source that gives a total uses the same number: 1,332,826 people, taken from the Texas filing. SecurityWeek says it has asked Amplifon to confirm this figure and had not received a reply when it published.
Amplifon says it is "not aware of any fraudulent use of personal information as a result of this incident." Abington Cole + Ellery reports that the company is offering 24 months of free credit monitoring and identity protection to some of the affected people.
Why It Matters
Many victims may not recognise the company's name. Much of Amplifon's US business runs hearing benefits on behalf of health plans and employers. As Emery Reddy points out, many affected people may know Amplifon only as the name behind a hearing benefit in their insurance plan, not as a clinic they ever went to. Notification letters from a company people don't recognise are often thrown away, and scammers can easily copy them.
The stolen data is well suited to fraud. Names, dates of birth, government ID numbers, insurance member IDs and medical history together are enough for medical identity theft, insurance fraud and very convincing phishing. Medical details cannot be changed the way a password can. Hearing loss is also more common among older people, who are already frequent targets of phone and mail fraud.
The delay helps attackers. For about nine months, the people affected did not know their data was out there. If the data was sold or passed around during that time, criminals had a long head start before anyone was warned.
Several class action investigations have started. At least four law firms (ClassAction.org's partner attorneys, Abington Cole + Ellery, Emery Reddy and Edelson Lechtzin) have opened investigations, and no lawsuit filings have been reported yet. Expect a lawsuit to be filed and questions about why notification took so long.
The Attack Technique
The method is unknown. Edelson Lechtzin, citing the regulatory filings, says Amplifon has described the event only as a "network security incident." The company has not said whether ransomware was involved, whether a vendor or third party was the way in, or how the attackers got access. No ransomware or extortion group has publicly claimed the attack. The Texas and Vermont filings also do not say whether Amplifon's operations were disrupted.
What is confirmed is what the attackers did once inside. They took files from several internal systems over about three weeks. Taking data from multiple systems for that long without being stopped points to weak monitoring of outbound data and of access to stored files. Data theft followed by a long gap before disclosure also fits the pattern of extortion crews that steal data without encrypting anything. That is a reasonable guess, not a confirmed finding.
What Organizations Should Do
- Watch for large outbound data transfers. Set alerts for unusual amounts of data leaving file servers, document stores and databases holding patient or member records, especially to cloud storage or unfamiliar destinations. Three weeks of copying should trigger alerts within hours.
- Plan how you will review stolen data before an incident happens. It took about eight months here to work out whose data was in the stolen files. Keep an up-to-date map of where personal and health data lives, and have a data-mining or e-discovery vendor on retainer so you can identify affected people in weeks, not months.
- Store less and separate what you store. Social Security numbers and financial data turned up in files from systems that mainly held hearing and insurance records. Remove or tokenise Social Security numbers where they aren't needed, and keep them out of everyday file shares and operational systems.
- Lock down how people log in to internal systems. Require phishing-resistant multi-factor authentication for remote access and admin accounts. Review dormant and service accounts, and limit how far one compromised account can reach across your network.
- Benefit administrators and partners should check their own exposure. Health plans and employers that use outside benefit administrators should confirm what member data those vendors hold, how quickly they must report a breach under contract, and how members will be told. Prepare member-facing messages so that legitimate notices aren't mistaken for scams.
- Prepare for follow-on fraud. Insurers, clinics and pharmacies serving hearing care patients should expect more social engineering that uses the stolen member IDs and dates of birth. Tighten identity checks for account changes, claims and prescription requests.
Sources: Amplifon Americas Data Breach Impacts 1.3 Million - SecurityWeek | Amplifon Data Breach Exposes Sensitive Medical Info; Lawsuit Possible | Amplifon Data Breach Class Action Lawsuit Investigation 1,332,826... | Amplifon Data Breach 2026: 1.3 Million Affected Emery Reddy | Amplifon Data Breach Investigation: Edelson Lechtzin LLP Probes Cla... | Amplifon, Inc. Data Breach Settlement & Claim (Vermont 2026) | Amplifon (USA) reports data breach affecting 85,804 Texas residents... | Amplifon Data Breach Exposes SSNs and Health Records