Amplifon Data Breach: An Eight-Month Gap Between Detection and Notice

Amplifon disclosed a data breach through its own notice and through filings with the California and Vermont Attorneys General. The filings show an unauthorized party took files between 18 January and 8 February 2026. Amplifon says it detected the activity on 11 February 2026, but did not determine that personal data was affected until 6 October 2026, eight months later.

1. 2026-01-18Unauthorized access beginsAn unauthorized third party obtains files from certain Amplifon systems, per Amplifon’s own notice and the California AG filing.
2. 2026-02-08Unauthorized access endsThe file-access window closes, per the same two sources.
3. 2026-02-11Amplifon detects suspicious activityAmplifon says it immediately launched an investigation, notified law enforcement and contained the incident.
4. 2026-10-06Amplifon completes its reviewAmplifon determines recipients’ personal information may have been impacted, eight months after detection.
5. 2026-11-05Amplifon notifies regulatorsFilings reach the California and Vermont Attorneys General the same day.

What the Amplifon Data Breach Timeline Shows

Two gaps stand out in Amplifon’s own dates. The first runs from detection on 11 February to Amplifon’s completed review on 6 October, about eight months. The second runs from that review to the first regulator filings on 5 November, about one month. Amplifon’s notice does not explain why the review took as long as it did.

This is our own reading of the gap, not a claim Amplifon makes about itself. A long review period is common in breaches involving health records, because confirming which specific data elements apply to which person takes longer than confirming that a system was accessed.

What Was Involved

Amplifon’s notice says the data that may have been involved includes name, contact information, date of birth, and a driver’s license or other state identification number. See our data breach glossary entry for how regulators define this term. It also lists hearing and medical information, medical record numbers, dates of service, other health-related information, and health insurance identification and information.

For a limited group of people, the notice adds Social Security numbers and financial information. Amplifon’s letter is a form notice with conditional fields that vary by recipient, so not everyone who received it had every data element listed above.

The notice explains two ways Amplifon came to hold this data. For some recipients, Amplifon had the information through their own interactions with the company or its franchise locations. For others, Amplifon says it works with health insurance plans to help provide plan benefits. That relationship is how it came to hold their information, even without a direct purchase from Amplifon.

That second path matters for anyone wondering why they received a letter from a hearing aid company they never used directly. A health plan’s own vendor relationship can bring a person’s data into a breach notice they did not expect.

What the Regulator Filings Add

The Vermont Attorney General’s filing, reported 5 November 2026, lists 1,027 Vermont residents affected and names the data breached as Social Security numbers and health records. The California Attorney General’s filing, reported the same day, names the organization as Amplifon (USA), Inc. and gives 18 January 2026 as the date of breach, matching Amplifon’s own notice.

• 1,027Vermont residents affected, per the Vermont AG filingSource: Vermont AG filing and Amplifon's own notice, 5 Nov 2026; Brandefense Blackhole, 12 Aug-10 Nov 2026
• 24Months of free identity monitoring Amplifon is offeringSource: Vermont AG filing and Amplifon's own notice, 5 Nov 2026; Brandefense Blackhole, 12 Aug-10 Nov 2026
• 3Mentions of Amplifon in Brandefense Blackhole’s monitored cybercrime channelsSource: Vermont AG filing and Amplifon's own notice, 5 Nov 2026; Brandefense Blackhole, 12 Aug-10 Nov 2026

Neither filing we opened states a nationwide total. A total figure circulates elsewhere, but we could not open a Texas regulator record to confirm it ourselves, so we do not repeat it here.

What Amplifon Is Doing

Amplifon says it took steps to secure its systems, disabled affected accounts, and increased monitoring. It is offering 24 months of identity monitoring through Kroll at no cost. Amplifon’s notice states, “We are not aware of any fraudulent use of personal information as a result of this incident.”

The Kroll offer has three parts. Single-bureau credit monitoring alerts a recipient when a new line of credit is applied for in their name. Fraud consultation gives unlimited access to a Kroll specialist for questions about identity protection. Identity theft restoration assigns a dedicated investigator if a recipient actually becomes a victim of identity theft.

What To Do If You Receive This Notice

Amplifon’s own advice is to review account statements and explanations of benefits for anything you do not recognize. It also says to contact the entity that holds the account if you see something suspicious. If you receive the letter, activating the Kroll monitoring before the stated deadline is a direct action the notice itself asks for.

Amplifon’s notice also recommends a free security freeze with each of the three major credit bureaus, separate from the Kroll monitoring offer. A freeze blocks new credit in your name more directly than monitoring alone, since monitoring only alerts you after a new account is opened. Our data breach response guide walks through this and the other steps in order.

Method: Where These Numbers Come From

Every date and figure above comes from Amplifon’s own notice or from the California and Vermont Attorney General filings. We opened and read all three directly for this post. The Brandefense Blackhole count is our own check, run on 10 November 2026 over the twelve weeks before that date.

We left out the nationwide and Texas figures reported elsewhere, because we could not open a primary record for either one. California and Vermont both publish breach filings openly. Texas does not run a public searchable database in the same way, and our direct request to its own reporting page was blocked. See our PowerSchool data breach page for another case where a vendor breach reached people who had no direct relationship with the breached company.