Amplifon Americas says on its security incident notice that it detected suspicious activity on certain systems on 11 February 2026, launched an investigation with external cybersecurity experts, notified law enforcement and contained the incident, disabling impacted accounts and increasing monitoring. The investigation found that between 18 January and 8 February 2026 an unauthorised third party obtained files from certain systems, and a review of the data indicated on 6 October 2026 that personal information may have been involved: name, contact information, date of birth, driver licence or other state or government ID number, hearing or medical information, medical record number, date of service, other health information, and health insurance ID and other insurance information; financial information or Social Security numbers of a limited number of people may also have been involved.

Amplifon says it is notifying affected people for whom it has a valid mailing address and offering 24 months of credit monitoring and identity protection to certain individuals, and that it is not aware of any fraudulent use of the information. (source: Amplifon Americas)

According to The Record (9 November 2026), Amplifon told Texas officials that 85,804 people were affected and Vermont officials 1,027, filed notices in California, and no hacking group had claimed the attack. (source: The Record)