Amplifon Data Breach

More than 1.3 million people may have had their Social Security numbers, medical information and health insurance details exposed in a data breach at hearing care company Amplifon (USA), Inc. The breach went undetected for about eight months.

Amplifon (USA), Inc. is the Minneapolis-based U.S. arm of Amplifon S.p.A., a hearing care company based in Milan, Italy. In the U.S., Amplifon runs hearing care benefit programs for health plans and employers, along with retail hearing care networks.

According to a report Amplifon filed with the Texas Attorney General, the breach affected 1,332,826 people, including 85,804 Texans. The report says the breach happened between January 18 and February 8, 2026, and that Amplifon discovered it on October 6, 2026. The report says Amplifon is notifying people by U.S. mail and on its website.

Amplifon also notified the Vermont Attorney General on November 5, 2026, reporting 1,027 affected Vermont residents.

Eight Months Before Amplifon Found the Breach

The dates in the Texas report show a long gap:

• January 18 to February 8, 2026: the breach window
• October 6, 2026: Amplifon discovers the breach, about 240 days after it ended
• November 5 to 6, 2026: Amplifon reports to the Vermont and Texas Attorneys General

That means about nine months passed between the start of the breach and Amplifon’s first notice to regulators. During that time, affected people had no warning to watch their accounts. Amplifon has not publicly explained how the breach happened or why it went unnoticed for so long.

Who May Be Affected

Amplifon works with many health plans and employers to offer hearing care benefits. That means some affected people may know Amplifon only through their health plan’s hearing benefit, not as a store they visited.

People who received a notice letter from Amplifon (USA), Inc., or who used hearing care benefits that Amplifon administers, may be affected. Amplifon has not said which programs or health plans’ members are involved.

What Information Was Exposed in the Amplifon Breach?

According to the Texas Attorney General report, the information involved includes:

• Name, address and date of birth
• Social Security number
• Driver’s license number and government-issued ID number
• Financial information (account or card number)
• Medical information
• Health insurance information

Vermont’s listing names Social Security numbers and health records. Not every person had every item exposed, and the exposed details may differ by state.

What Is Amplifon Offering Affected People?

Amplifon has not publicly disclosed whether it is offering credit monitoring or identity protection. Neither Texas nor Vermont publishes the notice letters themselves, and no copy of the letter was available at the time of writing.

Affected individuals can take these steps now:

• Read the notice letter closely and follow any enrollment instructions it includes
• Place a free credit freeze with Equifax, Experian and TransUnion
• Review bank and card statements for charges you do not recognize
• Check explanation of benefits statements for hearing care or other services you did not receive
• Request an Identity Protection PIN from the IRS

Why This Combination of Data Is So Dangerous

This breach may include both the details needed for financial identity theft and the details needed for medical identity theft. A Social Security number, date of birth and driver’s license number can be used to open new accounts. Health insurance and medical information can be used to bill for care or devices in someone else’s name. Financial account or card numbers can lead to direct charges.

What Legal Options Do Affected Amplifon Patients and Members Have?

Healthcare companies that collect patients’ Social Security numbers, medical records and insurance information have a legal duty to protect it and to notify people promptly when it is exposed. When that duty is not met, affected individuals may have legal rights and remedies worth discussing with an attorney.

Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review. 

Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.

Much of the information involved in this incident may also qualify as Protected Health Information (PHI). PHI includes medical or healthcare-related data protected under federal and state privacy laws. When PHI is compromised, it can be misused for medical identity theft or insurance fraud.

Frequently Asked Questions

How many people were affected by the Amplifon data breach?

According to the Texas Attorney General report, 1,332,826 people were affected, including 85,804 Texans. Vermont lists 1,027 residents.

What information was exposed?

According to the Texas report, the information includes:

• Name, address and date of birth
• Social Security number
• Driver’s license and government ID numbers
• Financial account or card information
• Medical and health insurance information

When did the breach happen?

The Texas report lists a breach window of January 18 to February 8, 2026. Amplifon discovered it on October 6, 2026, about eight months later.

I never visited an Amplifon store. Why would I be affected?

Amplifon runs hearing care benefit programs for health plans and employers. If you used a hearing benefit through your health plan, Amplifon may have held your information.

What should I do if I received a letter?

Take these steps:

• Follow any enrollment instructions in your letter
• Freeze your credit with all three bureaus
• Watch your bank, card and insurance statements
• Get an IRS Identity Protection PIN
• Keep your letter for your records

Why is medical information so valuable to criminals?

Unlike a credit card, you cannot cancel your medical history. Criminals can use health and insurance details to bill for care you never received, fill prescriptions or file false insurance claims. These problems can show up months later on a bill or an explanation of benefits.

Could scammers use this breach to contact me?

Yes, that is a common follow-up risk. Scammers sometimes send emails, texts or calls that mention a real breach by name to seem trustworthy. Do not click links or share codes or passwords with anyone who contacts you about the breach. Use the phone number printed on your official letter instead.

Do I have a legal claim?

Possibly. Healthcare companies that collect Social Security numbers, medical records and insurance information have a duty to protect it and to tell people promptly when it is exposed. If that duty was not met, you may have legal rights. Contact Emery | Reddy at 916.995.5968 or visit www.emeryreddy.com for a Free Case Review. No Fee Unless We Recover.