Amplifon data breach letter: files taken January 18 to February 8, 2026, letters sent in November

Date	Event
January 18 to February 8, 2026	Files obtained from some Amplifon systems
February 11, 2026	Amplifon detects suspicious activity
October 6, 2026	Review shows recipients' information may be in the data
November 5, 2026	Notices recorded in California, Washington and Vermont
November 9, 2026	Massachusetts records the report (19,276 residents)

What happened in the Amplifon data breach?

Amplifon says it detected suspicious activity on certain systems on February 11, 2026. It started an investigation with outside cybersecurity experts, notified law enforcement and contained the incident. The investigation found that files had been taken in the three weeks before detection. Amplifon says it disabled affected accounts and stepped up monitoring for suspicious activity. The letter does not say how the intruder got in or whether ransomware was involved. It says Amplifon is not aware of any fraudulent use of the information.

Why did I get a letter from Amplifon?

There are two routes, and the letter says which one applies. Some recipients dealt with Amplifon or one of its franchise locations directly. Others are members of a health insurance plan that works with Amplifon to provide hearing benefits. Those letters name the plan. Amplifon's site describes the business the same way: hearing care offered through partnerships with health and ancillary plans. If you have never visited an Amplifon location, check whether your letter names a health plan. Why you got a breach letter from a company you never dealt with covers that case.

What information was exposed in the Amplifon breach?

The filed letter is a template, and the list of data is filled in per person. Some versions add that the recipient's Social Security number, financial information or both were not involved. The state records show the range across everyone notified:

State	Residents	Categories recorded
Massachusetts	19,276	Social Security numbers, medical records, driver's licenses
Washington	8,491	Name, SSN, driver's license or state ID, financial and banking information, date of birth, health insurance ID, medical information, other
Vermont	1,027	Social Security numbers, health records

Why did the Amplifon letter take nine months?

Amplifon detected the activity on February 11, 2026. The first state records are dated November 5, 267 days later. The letter attributes the gap to the review of the data: it was October 6 when that review showed a given person's information may have been involved. The HIPAA rule's limit for notifying individuals runs from discovery of the breach. The HIPAA Breach Notification Rule entry explains how that applies when a company acts for a health plan, and the notice-delay guide compares the gap with others in the log.

What is Amplifon offering people who got the letter?

Twenty-four months of Kroll identity monitoring at no cost: credit monitoring, fraud consultation and identity theft restoration. Activation is at enroll.krollmonitoring.com/redeem with the codes printed on the letter, by the date printed there. Questions go to the Amplifon call center at (844) 971-8634, Monday through Friday, 8:00 a.m. to 5:30 p.m. Central. The letter also suggests reviewing account statements and health plan explanations of benefits.