Amplifon (USA), Inc. filed a Texas Attorney General notice on 6 November 2026 for a data breach covering 1,332,826 people, including 85,804 Texans. The catalog entry uses that total. The access window in the filing is 18 January to 8 February 2026. Amplifon discovered the incident on 6 October, about eight months after the window closed. Vermont's listing on 5 November names 1,027 residents. Fields can include names, addresses, dates of birth, Social Security numbers, driver licences and other government IDs, financial accounts, medical information and health insurance. Not every person had every field.
Amplifon (USA) is the Minneapolis arm of Milan-based Amplifon. In the United States it runs hearing-care benefit programmes for health plans and employers, plus retail hearing networks. The Texas filing classifies the entity as a healthcare medical provider and describes a network security incident. It does not name ransomware, a vendor, or an intrusion method. Law-firm pages advertising a class action are not a census. The Texas number is.
What happened in the Amplifon data breach?
Public facts are still thin for a 1.33 million-person healthcare filing. An unauthorised party had access to Amplifon systems between 18 January and 8 February 2026. Amplifon says it found that activity on 6 October. Notices to Vermont and Texas followed in early November. The company said it is notifying people by US mail and by posting on its website. It has not published a technical post-mortem or an explanation of the eight-month detection gap.
That gap is the operational fact patients can use. For most of 2026, people in the file had no reason to freeze credit or watch an Explanation of Benefits for hearing-aid claims they did not make. A late notice does not make the census smaller. It does change how you read "we have no evidence of misuse." Absence of evidence after eight quiet months is weaker than the same sentence the week of an intrusion.
This is a different pattern from EyeMed's 19,425-person misdirected-email notice, which the California sample letter describes as human error on a single day. Amplifon's filing is a multi-week network window with a much larger population. It is also different from the Quest Diagnostics Quanum LSM incident, which is confirmed patient-record access without a published count yet.
What data was exposed?
Texas lists name, address, Social Security number, driver licence or government-issued ID, financial information such as an account or card number, medical information, health insurance information and date of birth. Vermont's public listing highlights Social Security numbers and health records. Healthcare filings almost always add the caveat that elements vary by individual. Read your letter. If it omits SSN, do not assume Texas's full menu applies to you. If it includes SSN and a medical record number, treat it as identity theft material, not a marketing-list leak.
Hearing-care files can include device serial numbers, audiograms and insurer IDs. The public AG rows do not itemise those clinical objects. They do itemise medical information and health insurance. Watch for claims billed against your hearing benefit that you did not incur.
Who is affected?
People whose records Amplifon (USA) held in the January to February window: benefit members, retail patients, and possibly employees. The 1,332,826 figure is the company's total in the Texas filing, not a Texas-only count. 85,804 is the Texas slice. 1,027 is Vermont. Other states may appear as letters land. If you get a letter, you are in the 1.33 million. If you used Amplifon hearing benefits in early 2026 and get no letter, wait for the mail window before assuming you are clear.
Italian parent-company patients outside the US arm are not described in these US filings. Do not merge an EU story into this census.
What should I do after the Amplifon notice?
- Keep the letter. It is the document that lists your fields and any monitoring offer.
- If a Social Security number is listed, freeze credit at Equifax, Experian and TransUnion. A fraud alert is weaker than a freeze.
- Get an IRS Identity Protection PIN if you have not already.
- Read health-insurance explanations of benefits for hearing exams, devices or batteries you did not receive.
- Treat calls about "Amplifon settlement" or "hearing-aid recall" as hostile unless you placed them to a number on the letter.
The RevSpring Social Security notice is the same practical playbook: freeze first, then read medical bills, then ignore copycat legal ads that ask for your SSN to "check" the class.
Frequently asked questions
Is 1.33 million confirmed?
Yes as a company figure in the Texas Attorney General filing of 6 November 2026. It is not a leak-site claim.
Was this ransomware?
The filing does not say. Do not label it ransomware until Amplifon or a regulator does.
Why did notice take so long?
Discovery is dated 6 October, months after the February end of the access window. Amplifon has not explained the delay in the materials reviewed for this post.
Does every person have an SSN in the file?
No. The filing lists data types that may have been involved. Your letter is the individual record.
Should I join a class action from a search ad?
That is a legal choice, not a security step. Do not give your SSN to a form that is not the official notice or your own counsel.
Sourcing note: the 1,332,826 total, Texas slice, dates and field list come from the Texas AG filing as reported in secondary aggregations of that filing. We could not open a stable deep link to the Texas row itself. Vermont's 1,027 figure is from the Vermont listing date of 5 November 2026.