Amplifon Americas notice dates its data review 237 days after detection; Texas filing lists 1.33 million

237 days from detection to the data review finding, on a page with no date

Amplifon Americas's security incident notice says it "detected suspicious activity on certain systems within its network on February 11, 2026" and that a review of the impacted data "indicated on October 6, 2026" that certain information may have been impacted. That is 237 days from detection to the review finding (derived, counted by script), and 261 days from 18 January, the first day of the window in which the notice says files were obtained, to the same finding (derived). The notice does not say when it was published: the page carries no date, and this site could not find one.

That interval does not establish that anything was done wrong. The notice gives no reason for it, no start date for the review, and no date for the letters it says will go to individuals. It also states no count. A figure of 1,332,826 people comes from a Texas Attorney General filing as reported by SecurityWeek and reproduced by a third party mirror, BreachTally, and this site could not read the Texas record itself. Everything here is as read between 14:23 and 14:45 UTC on Monday 9 November 2026. The sources are the notice, the Vermont Attorney General's own list, the mirror, and SecurityWeek, which is a secondary.

A note on interest, once: Amplifon sells hearing care, and its own site markets a hearing benefit to health plans, so the notice is the company's account of its own incident. BreachTally sells paid alerts on state filings. Neither is independent verification of the other.

What Amplifon says happened, in its own order

The notice is five short paragraphs. In its order: Amplifon Americas "recently learned about a security incident that may have involved certain personal information that we maintain". It then says "immediately launched an investigation with the support of external cybersecurity experts, notified law enforcement, and promptly contained the incident". Those are company statements. It gives no date for containment, no date for the law enforcement notice and no description of how the activity was detected.

The access window comes next: the investigation "identified evidence that between January 18 and February 8, 2026, an unauthorized third party obtained files from certain systems". The notice does not say when the investigation identified that evidence, so the date on which Amplifon first knew files had been obtained is not stated. The window is 21 days (derived). Detection was 3 days after its last date (derived). The notice does not say whether access stopped on 8 February because of containment, because the intruder finished, or for another reason, and it does not say whether the 11 February detection was of the same activity that ended on 8 February.

Zoom

Read the table from the bottom up. Once the review finding existed, the two regulator filings this site found followed in about a month (30 and 31 days, derived). The long interval is the one before it, and the notice says nothing about what filled it. SecurityWeek calls it an eight month review: "Amplifon needed eight months to review the stolen data and determine that personal information was potentially affected". The notice says no such thing. It gives one date for the finding and none for the start of the review, and 237 days is about 7.8 months (derived) from detection, not from any stated start of the review.

Who and what: the notice, the filings and the count

The notice lists what "may have been impacted": name, contact information, date of birth, a driver licence or other state identification number, another government issued identification number, hearing or medical information, a medical record number, a date of service, other health information, a health insurance ID number and other health insurance information. It then says "financial information or Social Security number for a limited number of individuals may also have been impacted". The notice does not say how many individuals that is.

Zoom

The count. The notice states none. SecurityWeek says the company's "filing with the Texas Attorney General's Office reportedly mentions a total of 1,332,826 people being affected nationwide". The BreachTally page, which reproduces what it says is the Texas record, prints the same total and adds 85,804 Texas residents, a report date of 6 November 2026 and a notice method of a website posting and U.S. mail. This site fetched the Texas Attorney General's own page. Its headings include "Number of Texans Affected", and it warns: "Details including number of affected Texans and whether notice was provided to them may change after a report is listed here." The rows load by script and were not in the page this site could fetch, so the Texas record is read only through the mirror. Texans are 6.4 percent of the 1,332,826 (derived). Subtracting the Texas and Vermont residents leaves 1,245,995 people in other states (derived, and assuming both are part of the total, which no source states); this site has no record for those states.

The Vermont list, read directly. The Vermont Attorney General's security breach notices page, last updated on 6 November 2026, lists a row dated 5 November 2026 for Amplifon (USA), Inc., type Health Care, 1027 Vermont residents, categories Social Security Numbers and Health Records. That is the one regulator record this site read for itself. It confirms that a filing was made and what it lists for Vermont; it does not carry the national count. A search of the California Attorney General's breach list for the name Amplifon returned no published entry when read ("There are currently no published reported breaches"), which shows only that no entry under that name was listed, not that none exists.

Whose data it is. The notice's own advice is to "contact the entity that maintains the information on your behalf". That wording reads as though Amplifon holds some of this data for other organisations. The notice does not say so, and does not name any client. Amplifon's separate HIPAA page says the company is "required by the Health Insurance Portability and Accountability Act" to "notify affected individuals following a breach of unsecured PHI", and the notice itself does not mention HIPAA. Whether the affected people are patients fitted by Amplifon, members of health plans with a hearing benefit, providers, or a mix is not stated in any source read.

Friendly labels doing the work of evidence

Four phrases carry weight in the notice. "promptly contained" is a claim with no date and no description. "may have been impacted" covers everything from files that were opened to files that were only reachable, and the notice does not say which. "limited number of individuals" has no figure. And "We are not aware of any fraudulent use of personal information as a result of this incident" is a statement about what the company knows after a review whose finding is dated 237 days after detection (derived); it is not a statement that no misuse has happened. Each is Amplifon's wording, and none is independently verified.

The notice also says an unauthorized third party "obtained files". That is narrower than SecurityWeek's "Hackers stole personal, health, and insurance information". The notice says nothing about theft for gain, extortion, publication or sale, and neither does any source this site read. No group has claimed the incident in any page read.

Where the sources differ

The differences are listed rather than resolved. SecurityWeek's article was published at 11:20 UTC on 9 November 2026 by its page data, and says it has emailed Amplifon for confirmation. The article follows the notice wherever they differ.

What to do, in order

Technical details

The notice prints no indicators, hashes, domains, addresses, malware names, vulnerabilities, queries or log lines, and no source this site read prints any for this incident. None are invented here. What the sources do print is the dates and the data fields. They are reproduced below so that a defender, a plan or a patient can check the wording.

The notice's own sentences on dates and data. Copied from the Amplifon notice page. A privacy or compliance team can use them to see exactly which fields are named and which dates are given, and that no count is given.

The company detected suspicious activity on certain systems within its network on February 11, 2026 and immediately launched an investigation with the support of external cybersecurity experts, notified law enforcement, and promptly contained the incident.
The investigation identified evidence that between January 18 and February 8, 2026, an unauthorized third party obtained files from certain systems.
A review of the impacted data indicated on October 6, 2026 that certain information may have been impacted.
The information that may have been impacted included name, contact information, date of birth, driver license or other state identification number, other government-issued identification number, hearing or medical information, medical record number, date of service, other health information, health insurance ID number, and other health insurance information.
The financial information or Social Security number for a limited number of individuals may also have been impacted.

The Texas record's wording, through a mirror. This is the text BreachTally prints under the heading of information compromised, as listed. It is the closest this site came to the Texas record. Treat it as a third party copy, not the Attorney General's own text.

Information involved: Name of individual, Address, Social Security Number Information, Driver’s License number, Government-issued ID number (e.g. passport, state ID card), Financial Information (e.g. account number, credit or debit card number), Medical Information, Health Insurance Information, Date of Birth. Discovered 2026-10-06. 1,332,826 individuals affected in total. Notice method: Posted at company website or special website, U.S. Mail.

The question the notice leaves open

Amplifon Americas says it detected the activity on 11 February, contained it promptly and began a review, and that the review reached a finding on 6 October. The notice, as read, has no date and asks search engines not to index it. It says the investigation identified evidence that files were obtained, and does not say when. Between 11 February and 6 October, who knew that files had been obtained, and who has since told the plans, providers and patients whose records may have been in them?

Key facts