Hearing aid giant Amplifon has started mailing notices to 1.33 million Americans after intruders spent three weeks inside its internal systems and walked out with names, hearing and medical histories, and Social Security numbers for some patients.
The breach hit Amplifon Americas, the Minneapolis-based arm of the Italian hearing healthcare group. Attackers entered in January and copied files between January 18 and February 8, according to the company notice.
Eight months to read the files
Three weeks of access became an eight-month review. Amplifon disclosed the incident on November 5 and 6, filing with the attorneys general of Texas, California, Vermont and Washington. Texas listed 85,804 residents within a nationwide total of 1,332,826, reported 271 days after the intrusion ended.
The stolen categories extend well past audiograms: driver’s license and passport numbers, dates of birth, health insurance details, and bank account data for an unspecified subset.
Why a hearing network matters
Amplifon runs a nationwide clinic network and administers hearing benefits for health plans, which makes it a payer-facing vendor as well as a provider. Records that link a person to hearing loss, hearing aid purchases and insurance coverage can support medical identity theft tied to durable medical equipment billing, a documented fraud pattern.
The company says it has found no fraudulent use of the data. It has not published a cause, and no threat group has been publicly tied to the intrusion.
Questions for covered entities
Any health plan or system that routes members into the Amplifon network should confirm whether affected members are being notified by the vendor or by the plan, and whether business associate obligations cover the passport and financial fields now in scope. Those data types sit outside the clinical record and are often missed during vendor risk review.
