Amplifon breach exposed SSNs and medical data for up to 1.33 million, with access window January 18-February 8

The Milan-based hearing aid provider discovered suspicious activity on February 11 and filed breach notices in Texas, Vermont and California last week. Texas alone lists 85,804 impacted residents while class-action firms tracking the incident cite a combined 1,332,826 victims; Amplifon has not reconciled the figures. Stolen elements include names, state IDs, financial information and protected health data tied to device fitting and auditory services.

Healthcare wearable manufacturers show a clear 2026 pattern of large-scale incidents. iRhythm reported 8.18 million affected in a separate event, while Medtronic, Boston Scientific and Stryker have each logged breaches exposing device telemetry and patient records. Procurement records and vendor risk assessments reveal these firms share overlapping suppliers and legacy EMR integrations that lack modern segmentation.

Official statements emphasize rapid containment; independent filings show the access window lasted at least three weeks before detection. No threat actor has claimed the data, leaving attribution open. The discrepancy between notified counts and plaintiff estimates points to incomplete logging rather than deliberate under-reporting.

Next steps include state AG investigations and potential HHS OCR review once the full victim list is validated. Expect class-action discovery to surface logs and third-party access agreements within 90 days.