Amplifon Americas, the Minneapolis-based U.S. arm of Italian hearing health care company Amplifon, says an intruder took files containing personal and health information, and a filing with the Texas attorney general lists 1,332,826 people affected nationwide, SecurityWeek reported Monday. The case shows how long a breach review can run: detection came in February, the finding on personal data in October.
What Happened
In a notice on its website, Amplifon Americas says an unauthorized third party obtained files from certain systems between Jan. 18 and Feb. 8, 2026. It detected suspicious activity on Feb. 11, brought in outside experts, notified law enforcement, disabled affected accounts and stepped up monitoring.
A review of the files indicated Oct. 6 that personal information may have been affected. That includes names, contact details, birth dates, driver's license and other government ID numbers, hearing and medical information, medical record numbers, dates of service and health insurance ID numbers. For a limited number of people, Social Security numbers or financial information were involved.
The company says it is not aware of any fraudulent use of the data. Certain people, including those whose Social Security or financial details were exposed, are being offered 24 months of free credit monitoring and identity protection. No attacker has been named, and SecurityWeek said it had asked Amplifon for more detail.
Why It Matters
Nearly eight months passed between detection and the finding that personal data was in the stolen files. Boards should expect regulators and plaintiffs' lawyers to examine gaps like that closely, and should know how long their own plans allow for reviewing stolen data.
The mix of data also raises the risk of targeted scams. Contact details paired with insurance numbers and dates of service let fraudsters write convincing messages that appear to come from a clinic or insurer. Amplifon advises recipients to review account statements and insurers' explanation-of-benefits forms for unfamiliar activity.
What to Watch
State filings often come before the federal tally. The Primary Wire reported in October that a Texas filing put Oracle Health's breach toll near 20 million, citing SecurityWeek. Watch whether the incident appears on the U.S. Department of Health and Human Services breach list and whether that count differs; iRhythm's figure there ran far above its early state notices. Also watch for any group claiming the theft and for lawsuits over the delay.
