Amplifon hearing-health breach exposes data of 1.3M patients

Amplifon Hearing Health Care told the Texas Attorney General's Office that an unauthorized party accessed its systems between Jan. 18 and Feb. 8, 2026, and copied files from specific company servers, according to SecurityWeek's reporting. The company's regulatory filing puts the number of affected individuals at 1,332,826 — names, contact information, driver's license and other government ID numbers, dates of birth, hearing and medical information, dates of service, and health insurance details were among the data taken, and Social Security numbers were included for a subset of patients, per law firm coverage of the filing. Amplifon says it has seen no evidence of fraudulent use of the data so far.

The gap between intrusion and disclosure is the part worth sitting with: suspicious activity was flagged in mid-February, but it took until October for the company to confirm which records were exposed, and until early November to notify patients. For a hearing-care provider, "hearing and medical information" isn't an abstract category — it's audiogram results, fitting notes, device serial numbers and appointment history, often synced from the connected hearing aid itself through a companion app on the patient's phone.

Why connected hearing devices raise the stakes

Modern hearing aids are no longer standalone acoustic devices — most current models pair over Bluetooth LE Audio with a companion app that adjusts programs, logs usage, and in many cases pushes data straight into the provider's patient record. Apple's Made for iPhone hearing device program has made iOS the default first platform for that pairing, which means the app layer sitting between a $3,000 device and a patient's PHI is frequently built, maintained and secured by whoever wrote that companion app — not necessarily the clinic or hearing-care chain whose name is on the invoice.

That's the same pattern regulators keep flagging across connected medical devices: the hardware gets FDA scrutiny, but the software layer around it — the app, the cloud sync, the account system — often doesn't get the same security rigor unless someone builds it that way deliberately. A device maker or hearing-care network weighing whether to license an off-the-shelf companion app platform or commission an iOS development team that treats PHI handling as a first-class requirement, not an afterthought, is making exactly the decision that determines whether the next breach notification takes eight months or eight days to write.

What this means for device makers building their own apps

A breach of this scale and duration is a reminder that "medical device software" doesn't stop at the regulatory submission. The companion app, the account database, and the sync pipeline between device and clinic are part of the same attack surface as the EHR — they just rarely get audited with the same rigor until something goes wrong.