Top-Secured cyber watch: independent analysis based on the official statement of Amplifon and on the press. Top-Secured is not affiliated with this company and will never ask you for your bank details or passwords.
Amplifon Americas, the US arm of the Milan-based hearing aid group, has confirmed that an intruder took files from its systems between 18 January and 8 February 2026. The company is only now notifying the people concerned: names, ID numbers, hearing and health data and insurance details are among the information involved.
What happened
In a notice published on its US website, Amplifon Americas says it detected suspicious activity on part of its network on 11 February 2026. The investigation, carried out with outside cybersecurity specialists, found that an unauthorised third party had obtained files from certain systems between 18 January and 8 February. The company says it was only on 6 October that its review of those files showed personal information could be involved. It informed law enforcement, disabled the affected accounts and strengthened monitoring. Notification letters are now being sent, and according to The Record the company began filing with US state regulators in early November.
What data and how many people
The notice lists names, contact details, dates of birth, driving licence and other ID numbers, hearing and medical information, medical record numbers, dates of service and health insurance details. For a limited number of people, financial information or Social Security numbers may also be involved; they are offered 24 months of credit monitoring. Amplifon gives no total. According to The Record, the filing made in Texas mentions 85,804 people; the company did not answer its questions about the overall number. Amplifon says it is not aware of any fraudulent use of the data, and no group had claimed the attack when the article was published. How the intruder got in has not been disclosed.
What to do now
- Customers of the US subsidiary: read the letter carefully, enrol in the monitoring if offered, and watch insurance statements for care you did not receive.
- Expect targeted phishing: messages quoting your appointments or equipment are more convincing with this kind of data.
- For companies: alert on large or unusual file transfers leaving your servers, and keep file access logs for at least a year.
- Map where personal data lives, so you can tell within days, not months, whose data was in the stolen files.
Our take
Three weeks of undetected access, then almost eight months to work out what was taken: this is the typical cost of servers without egress monitoring and of file shares nobody has mapped. Both can be fixed before the incident, not after.
Sources
- Amplifon Americas — Security incident notice
- The Record — Data breach at hearing aid giant Amplifon impacts thousands
How we choose, verify and write our analyses →
Check before you click, and check what your servers expose — free, no intrusion:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
