Amplifon Discloses February 2026 Cyberattack Affecting Patients' Hearing and Medical Records, Including Social Security Numbers

It took Amplifon roughly eight months to tell patients that their medical records, Social Security numbers, and hearing health information had been stolen, and that timeline sits at the center of a significant HIPAA compliance problem.

Amplifon, described as the world's largest hearing aid retailer with operations across 28 countries, publicly disclosed on November 12, 2026, that suspicious activity first detected in February 2026 had resulted in the exfiltration of sensitive patient data. The company stated that it required approximately eight months to review the stolen files and confirm whose information was involved before it could notify affected individuals.

This is a breach disclosure, not an enforcement action. No fine has been announced by the Office for Civil Rights or any other regulator as of the date of this article.

What Was Stolen

Based on available reporting, the categories of compromised data include:

• Full names and dates of birth
• Copies of driver's licenses
• Hearing health and broader medical information
• Health insurance identification numbers
• Social Security numbers (for some individuals)
• Financial data (for some individuals)

Reports suggest the breach may have affected up to roughly 1.3 million people, though that figure has not been independently confirmed at the time of publication. Given that the stolen data includes both medical records and government-issued identifiers, affected individuals face elevated risks of identity theft, medical identity fraud, and fraudulent insurance claims.

The Eight-Month Timeline Problem

This is where the story becomes directly relevant to every compliance officer, practice manager, and healthcare software vendor who handles protected health information.

HIPAA's Breach Notification Rule is unambiguous on timing. Under 45 CFR §164.404, covered entities must provide notification to affected individuals without unreasonable delay and in no case later than 60 calendar days after the discovery of a breach. Discovery is defined as the date a covered entity knew, or by exercising reasonable diligence should have known, that a breach occurred.

For large breaches affecting 500 or more residents of a state or jurisdiction, covered entities must also notify prominent media outlets in that jurisdiction under 45 CFR §164.406. And the Secretary of Health and Human Services must be notified simultaneously with individual notification under 45 CFR §164.408.

Amplifon's stated reason for the delay, that the company needed approximately eight months to review the stolen files and determine who was affected, reflects a workflow that many organizations use but that does not align with HIPAA's requirements. The 60-day clock does not pause while forensic work continues. Organizations are expected to begin notification processes within the 60-day window using the best available information, and to supplement notifications if additional individuals are later identified.

Why Forensic Timelines and Notification Timelines Must Run in Parallel

A common and costly misconception in breach response is that notification cannot begin until the investigation is complete. That approach produces exactly the kind of multi-month delays seen here.

Best practice, and the standard OCR has consistently communicated through guidance and enforcement history, is to run forensic investigation and notification planning simultaneously from the moment a breach is discovered. That means:

• Identifying the likely scope of affected data types as early as possible, even with incomplete information
• Engaging legal counsel and a breach coach within days, not months, of detection
• Setting internal escalation deadlines that are measured in weeks, not quarters
• Issuing notifications based on a reasonable, good-faith assessment of who was affected, with follow-up notices if the population expands

The Breach Notification Rule does provide that the 60-day period runs from discovery, and OCR has acknowledged that some investigation time is necessary. However, eight months is far outside any reasonable interpretation of that window, and the period does not reset simply because a company's internal review took longer than anticipated.

What This Means for Covered Entities and Business Associates

Amplifon's situation is a useful stress test for your own breach response plan. Consider the following questions:

Do you have a documented breach response timeline? Your incident response plan should specify exactly when escalation happens, who makes the notification decision, and what triggers the 60-day clock internally.

Is your forensic review process sequenced correctly? Forensic investigation and legal notification review should proceed on parallel tracks. Waiting for one to finish before starting the other is a compliance liability.

Are your business associates contractually aligned? Under 45 CFR §164.410, business associates must notify covered entities of discovered breaches without unreasonable delay and within 60 days. If a vendor discovers a breach, your 60-day clock as a covered entity begins at that point. Your business associate agreements should enforce rapid reporting, not 60-day windows that then restart your own 60-day window.

Do you have a process for large-breach media notification? If the number of affected individuals reaches the 500-per-state threshold, media notification is required and must happen on the same timeline as individual notification.

The Broader Risk Picture

The data categories exposed in the Amplifon breach represent a particularly serious combination. Medical records and hearing health information are sensitive PHI under HIPAA by definition. When those records are paired with Social Security numbers and financial data, the downstream harm potential for affected individuals extends well beyond healthcare, into credit fraud, tax fraud, and long-term identity compromise.

For compliance programs, the lesson is not only about notification timelines. It is also a reminder that the breadth of data an organization collects and retains directly determines the severity of harm when a breach occurs. Data minimization practices, strong access controls, and encryption of data at rest and in transit all reduce breach impact before an incident ever happens.

The HHS Wall of Shame, formally the Breach Portal maintained under 45 CFR §164.408, will reflect this breach once Amplifon submits its required report. That public record, combined with the notification timeline, may draw regulatory scrutiny even in the absence of a formal complaint.