Amplifon’s US business is writing to people whose hearing records, ID numbers and insurance details were copied in an intrusion that began in January. A Texas regulator filing, as reported by SecurityWeek, puts the total at more than 1.33 million, and the gap of almost nine months between detection and letters should worry anyone who holds health data in the UK.
What happened
Amplifon (USA), Inc., the Minneapolis-based American arm of the Milan-headquartered hearing care group, has begun telling customers that their personal and medical information was taken in a cyber attack earlier this year. According to the company’s own breach notice, it first spotted suspicious activity on 11 February 2026. Its investigation later established that an intruder had been able to reach company files from 18 January until 8 February, a window of roughly three weeks, and had copied data from some systems during that period.
Letters to affected individuals started going out on 5 November, with notices lodged with state regulators in Texas, Vermont and California. The Record reported that Amplifon told Texas officials that 85,804 residents of that state were affected and Vermont that 1,027 were. The nationwide figure of 1,332,826 people is cited by several US class action firms and, according to SecurityWeek, appears in a filing with the Texas Attorney General. Amplifon has not publicly confirmed that total and did not respond to The Record’s request to do so.
No ransomware or extortion group had claimed the attack at the time of writing, and Amplifon says it has seen no evidence that the stolen details have been misused. US class action firms are already seeking claimants.
The technical picture
Amplifon has said very little about how the attacker got in, which systems were involved or whether anything was encrypted. What is known is the shape of the incident: a period of undetected access lasting about three weeks, data copied out of internal file stores, detection on 11 February, and then a long document review before anyone was told.
The data set is what makes this serious. Depending on the individual, the exposed records include names, contact details, dates of birth, driving licence and other government ID numbers, clinical and hearing details, patient record numbers, appointment dates, health insurance identifiers and, for some people, Social Security numbers and financial details. That is close to a complete identity kit, joined to clinical information about a condition that skews towards older people.
SecurityWeek attributes the near nine-month gap between detection and notification to roughly eight months spent reviewing the stolen files to establish whose information they held. ClassAction.org, summarising Amplifon’s notice, says the company concluded on 6 October that personal data may have been affected. When attackers take whole shares rather than a single database, the organisation has to establish what was in thousands of unstructured documents, spreadsheets and scanned forms before it can say who is affected.
Why it matters for UK organisations
Nothing published so far suggests UK customers are caught up in this incident. The notices relate to the US business. But the group is a familiar name here: Amplifon’s UK web address now redirects to Audika, which says that “Hidden Hearing and Amplifon have become Audika” and advertises more than 280 hearing clinics across the country. The case is a useful mirror for any UK provider of private health services.
Under UK GDPR, hearing and medical information is special category data, and a personal data breach that is likely to put people at risk must be reported to the Information Commissioner’s Office within 72 hours of the organisation becoming aware of it. Where the risk to individuals is high, they must be told without undue delay. The ICO accepts that the full picture may not be clear in three days and allows information to be provided in phases, but it does not accept waiting for a complete forensic review before saying anything. A silence of almost nine months would be very hard to defend in front of a UK regulator.
The sector profile matters too. Audiology, optometry, dentistry, physiotherapy and private diagnostics are now largely delivered by chains and franchise groups that hold clinical notes, NHS and insurance identifiers and payment data in the same estate. They tend to receive less scrutiny than NHS trusts but hold comparably sensitive records, and they are attractive to criminals because the data is easy to monetise through fraud and targeted scams.
Expert view
In my experience, the long tail in cases like this is almost never the containment. It is the data discovery. When we test health and retail estates, the crown jewels are seldom confined to the clinical system that everyone has carefully locked down. They sit in exports, shared drives, scanned referral letters and old spreadsheets that nobody has catalogued, and that is exactly the material an intruder can copy quickly and a defender then spends months trying to understand.
The three-week dwell time is also telling. It suggests weak detection of unusual file access and outbound transfers, although Amplifon has not said how the intrusion was spotted. Organisations that only alert on malware or failed logins will miss that kind of activity.
Finally, the people affected here are likely to include many older and potentially vulnerable patients. A criminal who knows someone’s hearing condition, clinic visits and insurer can write a very convincing phone call or letter. The harm from breaches like this often lands months later as fraud, not on the day of disclosure.
What to do now
- Map where health data actually lives. Inventory file shares, cloud storage and mailboxes for clinical and ID data, not just the practice management system. You cannot notify quickly if you do not know what was there.
- Prepare for a phased ICO report. Write a breach playbook that gets an initial notification in within 72 hours and updates later, with named owners and pre-approved templates for patient letters.
- Detect bulk access and exfiltration. Alert on unusual volumes of file reads, archive creation and large outbound transfers, and retain logs for long enough to reconstruct a three-week intrusion.
- Tighten access control. Apply least privilege to shares holding special category data, enforce MFA on remote access and admin accounts, and remove stale accounts, in line with the Cyber Essentials user access control requirements.
- Keep systems patched and hardened. Cyber Essentials secure configuration and security update management controls close many of the common entry routes into small clinic networks.
- Minimise and retire data. Purge or archive old exports and scanned documents you no longer need. Data you do not hold cannot be stolen.
- Warn patients about follow-on scams. If you are a provider in this space, remind patients that you will not ask for card details or ID by cold call.
Bottom line
The Amplifon case is a US incident with no confirmed UK victims, but it is a clear illustration of what goes wrong when a health provider cannot quickly tell what was stolen. Under UK rules, waiting nearly nine months is not an option. UK clinics and private health groups should use it as a prompt to find their sensitive data, watch it properly and rehearse a notification that can happen in days rather than seasons.
Sources
- The Record: Data breach at hearing aid giant Amplifon impacts thousands
- SecurityWeek: Amplifon Americas Data Breach Impacts 1.3 Million
- Cole & Van Note: Amplifon Data Breach Investigation
- ClassAction.org: Amplifon Data Breach Exposes Sensitive Medical Info
- Audika UK: Hearing clinics (formerly Amplifon and Hidden Hearing)
