Hearing care company Amplifon has disclosed a data breach affecting more than 1.3 million people in the United States, after hackers stole files containing Social Security numbers, medical information and health insurance details. The breach went undetected for about eight months before the company discovered it.

Amplifon Americas, the Minneapolis-based arm of the Italian hearing healthcare group Amplifon, told regulators that hackers broke into its internal systems and copied files between 18 January and 8 February 2026. The company discovered the intrusion on 6 October 2026, roughly eight months after the access ended, and needed further months to review the stolen data and work out whose personal information was involved.

1.3 million people affected

According to a report filed with the Texas Attorney General on 6 November 2026, the breach affected 1,332,826 people nationwide, including 85,804 Texans. Amplifon also notified the Vermont Attorney General on 5 November 2026, reporting 1,027 affected Vermont residents. The company is notifying affected people by post in the United States and through a notice on its website.

The stolen data includes names, contact information, dates of birth, driver's licence numbers and other government-issued ID numbers, medical and hearing information, medical record numbers, dates of service, and health insurance information. Financial account information and Social Security numbers were also exposed, although Amplifon says that affected only a limited number of individuals.

How the breach was discovered

In a breach notice on its United States website, Amplifon said it first spotted suspicious activity on 11 February, and its investigation later showed that hackers had access to company files from 18 January. The company has not publicly explained how the attackers got in or why the intrusion went unnoticed for so long.

Amplifon has described the incident as a network security incident and has not identified ransomware, a vendor, or the method of intrusion. No hacking group has claimed responsibility for the attack. The company said it is not aware of any fraudulent use of personal information as a result of the incident, but that does not rule out misuse in future, since stolen identity and health data can be used months or years later.

What affected people should do

Anyone who received a notice letter from Amplifon, or who used hearing care benefits administered by the company, may be affected. Amplifon works with many health plans and employers to offer hearing care benefits, and it has not said which programmes or health plans' members are involved.

Affected people should read any notice they receive carefully, watch for unexpected bills or insurance claims, and consider placing a fraud alert or credit freeze with the major credit bureaus. The filings do not state whether Amplifon is offering complimentary credit monitoring or identity protection, so anyone affected should check the notice for the details of what help, if any, is being offered.

Amplifon, founded in Milan in 1950, says it serves more than 80 million members through a nationwide network of thousands of clinics in the United States. The scale of the breach, and the eight-month gap before it was discovered, will raise questions about how the company monitors its systems and how quickly it can spot an intruder inside its network.