A hearing test produces a strange mix of paperwork: audiogram results and device fittings sit in the same file as a birth date, a driver’s license number and a health insurance ID. Amplifon Americas, the U.S. arm of the Italian hearing-care company, has now told regulators that files of exactly that kind were copied from its systems. A Texas attorney general filing dated Nov. 6 lists 1,332,826 people nationwide, or about 1.33 million.
Read next on Morning Overview: Cadillac cut the price of its cheapest EV, which goes up to 317 miles on a charge
The intrusion itself is months old. An unauthorized party took files between Jan. 18 and Feb. 8, 2026, and the company spotted suspicious activity on Feb. 11. The people who actually had to be told were not identified until a data review reached its conclusion on Oct. 6, which is why the notices and state filings surfaced in early November.
The Texas filing and the 1,332,826 count
The figure comes from the filing Amplifon (USA), Inc. made with the Texas attorney general, which a public tracker of that notice reproduces: 1,332,826 individuals in total, of whom 85,804 are Texas residents. The same record gives the breach window as Jan. 18 to Feb. 8, matching the company’s own account of when files left its systems.
Reporters have been careful about the number’s standing. SecurityWeek described the total as listed in a Texas filing “reportedly,” and The Record wrote that Amplifon did not respond to requests to confirm it, adding that class action law firms had already put the same total in circulation. Smaller state counts appear in the same coverage: 1,027 Vermont residents, plus a template notice lodged with the California attorney general. A summary of the Texas filing that first circulated the figure ties the 1.33 million total to the Nov. 6 date.
Hearing records, insurance IDs and government ID numbers
What was taken differs from person to person, which is typical of a breach counted by file rather than by account. Amplifon’s own security-incident notice lists names, contact details, dates of birth, driver’s license or state ID numbers, other government ID numbers, hearing or medical information, medical record numbers, dates of service, other health information, and health insurance ID numbers and related insurance details.
For a limited number of people the notice adds financial information or Social Security numbers. The Texas record as tracked online goes further, listing passport numbers and bank account information among the exposed categories, so the sensitive end of the range may be wider than the company’s short notice suggests.
The data came to Amplifon through two channels, according to the sample letter on file with the California attorney general: customer interactions with the company or its franchise locations, and its work with health insurance plans. A person who never bought a hearing aid from an Amplifon store could therefore still be in the pool if an insurer routed a benefit through the company.
Eight months between detection and the review of the stolen files
Amplifon says it moved quickly on the technical side. It engaged outside cybersecurity experts, notified law enforcement, disabled the affected accounts and increased monitoring. SecurityWeek reported that the company “immediately contained the incident,” yet the work of working out whose data sat in the stolen files took until October, roughly eight months after the Feb. 11 discovery.
That gap matters in practice because identity documents do not expire on a breach schedule: a driver’s license number copied in January remains usable by whoever holds it, and affected people learned of the exposure only as notices began to be mailed in November. The company’s position on misuse is narrow and carefully worded. It states it is “not aware of any fraudulent use of personal information” resulting from the incident. The Record noted that no hacking group had claimed responsibility as of its Nov. 9 report, so there is no public leak site or sample against which that statement can be checked.
Free monitoring and the steps the notice lists
Certain affected individuals, including the limited group whose Social Security or financial details may be involved, can enroll in 24 months of free credit monitoring and identity protection. The California sample letter names Kroll as the provider and lists single-bureau credit monitoring, unlimited consultation with a fraud specialist and identity theft restoration. Eligibility is set out in the individual mailed notice, and the activation code and deadline in the sample are blank placeholders.
The company advises recipients to review account statements and explanations of benefits from their insurers and to report anything suspicious to the organization that holds the information. The sample letter adds the standard options of a free one-year fraud alert or a free credit freeze, and points to IdentityTheft.gov for anyone who suspects theft. Questions go to a toll-free line at (844) 971-8634, open Monday through Friday from 8:00 a.m. to 5:30 p.m. Central.
One date in the paperwork remains unexplained: both the web notice and the sample letter give Oct. 6, 2026 as the day the data review pointed to affected information, a date that sits oddly beside page text carrying an earlier version stamp. Amplifon has not said whether the notice was updated after that review or whether the date was entered in error.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- 11 engines built to run well past 200,000 miles
- Two Kentucky residents died when a small plane crashed at Missouri’s Lake of the Ozarks, and the NTSB is investigating
- A handful of car transmissions are so tough that mechanics say they almost never die
- Melting permafrost is setting off a newly identified kind of catastrophic landslide, scientists say
