Amplifon Americas disclosed a breach affecting 1,332,826 people after an unauthorized party copied files containing health and insurance information.

 

What happened

Amplifon Americas, the Minneapolis-based US arm of the hearing care group Amplifon, detected suspicious activity on February 11, 2026, according to its security incident notice. The company brought in external cybersecurity experts, notified law enforcement, disabled affected accounts, and added monitoring.

The investigation found an unauthorized third party obtained files from certain systems between January 18 and February 8. A review of the affected data on October 6 indicated personal information may have been impacted. Amplifon filed with the Vermont Attorney General on November 5 and the Texas Attorney General on November 6, and SecurityWeek reported the total on November 9.

 

Going deeper

SecurityWeek reports the Texas Attorney General filing lists 1,332,826 people. The Vermont Attorney General's security breach notices page lists 1,027 Vermont residents, classifies the entity as health care, and names Social Security numbers and health records. The page notes the count may rise as the company determines the total number of people affected.

For a limited number of people, Social Security numbers or financial information may also be affected. Amplifon is mailing notices to people with valid addresses, with enrollment details for 24 months of credit monitoring and identity protection for certain individuals.

 

What was said

Amplifon says it is "not aware of any fraudulent use of personal information" as a result of the incident. SecurityWeek said it had emailed Amplifon for confirmation of the impact. The notice does not name the attack method, the systems involved, or the company's role under HIPAA.

 

Why it matters

About eight months passed between the end of the access window and the Texas filing, which BreachTally counts as 271 days. Under 45 CFR 164.404, a covered entity must notify individuals without unreasonable delay and no later than 60 calendar days after discovery. Discovery is the first day a breach is known or would have been known with reasonable diligence. Whether the review period fits the rule depends on Amplifon's HIPAA role, which the public documents do not state.

Nothing in the notice ties the incident to email. The data types match what staff handle in messages every day, and Paubox's 2026 Healthcare Email Security Report found 74% of breached domains had ineffective DMARC protection across 170 email-related breaches reported to HHS in 2025.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

How long does a HIPAA covered entity have to notify individuals of a breach?

The notice must describe what happened, including the breach and discovery dates if known, the types of information involved, steps individuals can take, what the entity is doing in response, and contact procedures such as a toll-free number, email address, website, or postal address.

 

Why can the number of affected people take months to emerge?

Organizations must review copied files to identify whose information was involved, and Amplifon's review took roughly eight months.

 

What must a covered entity include in a breach notice?

The notice must describe what happened, including the breach and discovery dates, the types of information involved, steps individuals can take, the entity's response, and contact procedures, including a toll-free number.