Sensitive health records, identification details, and insurance information were among the data compromised in a cyberattack targeting Amplifon’s US operations earlier this year. The hearing healthcare company is notifying affected individuals after an investigation confirmed that unauthorized parties had accessed and copied files from its internal systems.
The intrusion remained undetected for several weeks. According to Amplifon, attackers accessed company files between January 18 and February 8, 2026, but suspicious activity was not identified until February 11. The company subsequently engaged external cybersecurity specialists to investigate the incident and determine what information had been exposed.
The investigation, completed on October 6, identified several categories of potentially compromised information. These included names, contact details, dates of birth, driver’s license numbers, other government-issued identification numbers, medical record numbers, hearing-related information, dates of service, and health insurance details.
Social Security numbers and financial information were also affected, although Amplifon said these categories were involved only for a limited number of individuals. The specific information exposed varies between affected people.
The incident involves the US operations of the Milan-based hearing healthcare group, which operates internationally and provides hearing-related products and services. Its American business works with healthcare providers and insurance plans to deliver hearing benefits and related services.
The total number of affected individuals remains a point of uncertainty. Amplifon has not publicly confirmed a nationwide figure, although reports citing regulatory filings and legal investigations have placed the potential number at 1,332,826. State disclosures identify 85,804 affected Texas residents, 1,027 Vermont residents, and 8,491 Washington residents.
Following the discovery, Amplifon took steps to contain the intrusion, including disabling affected accounts and increasing security monitoring. The company has not publicly identified the attackers or explained how they initially gained access to its systems.
Amplifon said it has no knowledge of fraudulent use of personal information resulting from the breach. Nevertheless, it has advised affected individuals to review financial statements, health insurance explanations of benefits, and other records for suspicious activity.
Notification letters are being distributed to people whose information may have been compromised. Amplifon is also offering 24 months of complimentary identity monitoring services through Kroll, including credit monitoring, fraud consultation, and identity theft restoration assistance.
The company has established a dedicated assistance line for questions about the incident. Its notification materials also explain which categories of personal information were involved for individual recipients, allowing them to assess their specific exposure.