Amplifon Americas breach: files taken from hearing-care systems included hearing and medical information, government ID numbers and, for some people, Social Security numbers
Amplifon Americas says an unauthorised third party took files that may have included hearing and medical information and government ID numbers, and Social Security numbers for some people.
What happened
Amplifon Americas, the Minneapolis-based US arm of the Italian hearing-care group Amplifon, detected suspicious activity on certain systems in its network on February 11, 2026. The company says it immediately contained the incident, disabled impacted accounts, enhanced its monitoring and launched an investigation with the support of external cybersecurity experts, and that it notified law enforcement. The investigation found evidence that between January 18 and February 8, 2026, an unauthorised third party obtained files from certain systems. The review of the data in those files took months: on October 6, 2026, it indicated that certain personal information may have been impacted. Amplifon has posted a security incident notice on its website and reported the breach to state attorneys general — Vermont recorded its report on November 5, 2026 and Texas published its entry on November 6 — and SecurityWeek reported the disclosure on November 9. The company has not said how the intruder first got in.
Who is affected
People whose information Amplifon Americas maintains in the US — its hearing-care customers. The company’s notice lists the information that may have been impacted: name, contact information, date of birth, driver’s license or other state identification number, other government-issued identification number, hearing or medical information, medical record number, date of service, other health information, health insurance ID number and other health insurance information. For a limited number of individuals, financial information or a Social Security number may also have been impacted. Amplifon’s own notice gives no total count. SecurityWeek reported that the company’s Texas attorney-general filing mentions 85,804 affected Texas residents and a nationwide total of 1,332,826 people. The company says it will notify potentially affected individuals for whom it has a valid mailing address.
How serious
The concrete risk is identity fraud. A name, date of birth and government ID number — and, for the smaller group, a Social Security number or financial information — is the set a fraudster needs to try opening accounts or filing false claims in someone else’s name. The health side adds a second risk: hearing and medical information, medical record numbers, dates of service and health insurance ID numbers can be used for medical identity fraud, including false insurance claims that pollute a victim’s own health record. Contact details paired with real service dates also make targeted phishing easy to write convincingly. Amplifon says it is not aware of any fraudulent use of personal information as a result of the incident — but the files were taken in January and February 2026 and the review that identified the personal data was not completed until October, so “not aware” after that long a head start is limited comfort.
What to do now
Watch your mail: Amplifon says it will notify potentially affected people at the mailing address it holds, and its notice says the letter will include enrolment information for 24 months of free credit monitoring and identity protection services for certain individuals, including the limited number whose financial information or Social Security number was affected — if you are offered it, enrol. Consider a free credit freeze with the major credit bureaus, which blocks new accounts opened in your name whether or not a letter arrives. Review your account statements and your health insurers’ explanations of benefits for services you do not recognise, and report anything suspicious to the insurer or provider that issued it — the step Amplifon’s own notice advises. Questions go to the company’s call centre at (844) 971-8634, Monday through Friday, 8:00 a.m. to 5:30 p.m. Central, excluding major US holidays. Treat calls, texts and emails that trade on this breach with care: a genuine breach notice will not ask you to hand over a password or pay a fee to “protect” your record.
Sources: Amplifon Americas, “Amplifon Americas Security Incident” notice, November 2026 · SecurityWeek, “Amplifon Americas Data Breach Impacts 1.3 Million,” November 9, 2026