Amplifon Data Breach: 1,332,826 People, Some SSNs [2026] - shattered.io

The breach came to light through state attorney general filings rather than a company announcement. Texas reported 85,804 affected residents, Vermont listed 1,027, and California's record shows the breach began on January 18, 2026. Amplifon confirmed the unauthorized access lasted 22 days, ending February 8, with discovery occurring on February 11.

The company completed its investigation on October 6, 2026—237 days after detecting suspicious activity. Public notifications followed in November 2026. The breach potentially exposed names, addresses, birth dates, driver's license numbers, medical information, and financial data for over 1.3 million people nationwide.

Data Exposure Details

Social Security numbers were compromised for a limited number of individuals, though Amplifon hasn't specified how many. The company states this data was 'potentially involved,' meaning not every affected person lost every piece of information. Medical and hearing information represents a broader exposure category, including test results, insurance IDs, and service dates.

The breach raises HIPAA compliance questions, though no formal violation has been found. Medical identity theft poses a significant risk, as thieves could use insurance information to bill for unauthorized care. Hearing information adds another layer of vulnerability, potentially enabling targeted scams against those with hearing impairments.

Response and Next Steps

Amplifon is offering 24 months of credit monitoring and identity theft protection to affected individuals, particularly those whose financial information or Social Security numbers were compromised. The company hasn't released details about how attackers gained access or which specific systems were targeted.

Affected individuals should carefully review their notices to determine what personal information was exposed in their specific case. Those receiving letters without enrollment codes may not have had sensitive financial or SSN data compromised, though direct confirmation with Amplifon is recommended. The long investigation period—nearly eight months—highlights the complexity of identifying all affected individuals in healthcare data breaches.