Amplifon Reported a Data Breach Affecting 85,804 Texas Residents: What the Texas Filing Actually Says, and Where the 1.3 Million Figure Comes From

What the Texas Filing Says

Amplifon (USA), Inc. is listed in the Texas record at 150 S. 5th Street, Minneapolis, Minnesota. Amplifon Americas is the United States arm of the Italian hearing care group Amplifon, and it administers hearing benefits for health plans through a national network of hearing care providers and clinics.

Texas requires a business that suffers a breach affecting at least 250 Texas residents to report it to the Attorney General, and those reports are compiled in a public data security breach reporting listing. The Amplifon entry was published at the Attorney General website on November 6, 2026 and records 85,804 Texas residents affected.

The same entry records the categories of information affected: name of individual, address, Social Security number information, driver license number, government-issued identification number (for example a passport or state identification card), financial information (for example an account number or a credit or debit card number), medical information, health insurance information, and date of birth.

The entry also records that notice was provided to consumers, and the methods: posted at a company website or special website, and U.S. Mail. That is a meaningful difference from several of the larger Texas breach listings this year, where the record showed that letters had not yet gone out.

The Dates, and the Eight Months in Between

Amplifon Americas has described the sequence in its own breach notice, and the trade and security press have reported it consistently.

The company states that it detected suspicious activity on certain systems within its network on February 11, 2026, and that it began an investigation with outside cybersecurity experts, notified law enforcement and contained the incident. The investigation identified evidence that between January 18 and February 8, 2026, an unauthorized third party obtained files from certain systems.

The review that identified whose information was in those files was completed on October 6, 2026. State regulator filings followed in the first week of November. That interval between detection and notification is a factual feature of this incident, and it is one of the details attorneys look at when they read a breach record.

Amplifon has also stated that, for a limited number of individuals, financial information or a Social Security number may have been affected, and that it is not aware of any fraudulent use of personal information as a result of the incident.

According to the company notice as reported, the mailed notice includes enrollment information for 24 months of credit monitoring and identity protection services, at no charge to the individual, for certain people, including the limited number whose financial information or Social Security number was affected. The notice itself is the document that states who is eligible and how long the enrollment window runs, so it is worth keeping rather than discarding.

Where the 1.3 Million Figure Comes From

A figure of 1,332,826 people nationwide has circulated widely alongside this incident, and it is worth being precise about its source.

Recorded Future News reported that several class action law firms put the total number of affected people at 1,332,826, and that Amplifon did not respond to requests to confirm it. SecurityWeek reported the same number as something Amplifon filing material is said to mention, and also noted that it had emailed the company for confirmation. Separately, Amplifon reported 1,027 affected people to Vermont regulators and filed breach notices in California.

So the position is this: 85,804 is the Texas number in a Texas government record. The 1,332,826 nationwide total is a figure reported by firms investigating claims rather than one the company has publicly confirmed. Both can be stated accurately, and they are not the same kind of fact.

What Texas Law Requires After a Breach

These duties sit in statute, and they apply to the company rather than to the person who received the letter.

Under the Texas Identity Theft Enforcement and Protection Act, Texas Business and Commerce Code chapter 521, a business that owns or licenses computerized data including sensitive personal information must disclose a breach to each affected Texas resident without unreasonable delay and not later than the 60th day after the determination that a breach occurred. Where a breach affects at least 250 Texas residents, the business must also notify the Attorney General not later than the 30th day after that determination, and the Attorney General publishes the listing. The chapter also sets out the civil penalties available to the state.

Texas Business and Commerce Code chapter 20 separately gives a Texas consumer the right to place a security freeze on the consumer file held by a consumer reporting agency, which restricts the release of that file.

Deadlines on the other side matter too. Texas Civil Practice and Remedies Code section 16.003 sets a two-year limitations period for negligence actions, and the date a claim is treated as beginning to run in a breach case is itself a legal question rather than an obvious one.

Who in Texas This Reaches

The Texas listing does not break the 85,804 figure down by county or city. Amplifon Americas works with health plans and independent hearing care providers nationally, so the people in a listing like this are typically patients and plan members who were seen or enrolled through that network rather than customers of a single storefront.

Two groups are worth separating. People whose notice says a Social Security number or financial information was affected are in the smaller category the company describes as limited, and that is the category the credit monitoring enrollment is directed at. People whose notice describes medical record numbers, dates of service, hearing or other health information and health insurance identifiers are in the broader group; health information carries its own exposure, and it does not expire the way a card number does when the card is replaced.

What Kind of Claim or Option Might Apply

This is the part that depends entirely on one person facts, so it is framed as what a lawyer looks at rather than as what anyone should do.

Experienced Texas consumer protection attorneys describe reading a breach notice for a handful of things: which categories of data the notice actually lists for that person, what date the company says it determined a breach occurred, how that date lines up with the statutory notice periods, whether any misuse has shown up on accounts or on an explanation of benefits, and what the enrollment materials offer and for how long. Several class action firms have publicly said they are investigating claims arising from this incident, which means a person who received a notice may encounter solicitations about it; a lawyer can explain what joining or declining a proposed class action would mean for an individual before anything is signed.

Whether any of that supports a claim for one household is a question for a lawyer who can look at the actual notice. A lawyer can also explain how a security freeze works, what a notice does and does not commit the company to, and what records are worth preserving in the meantime.

Why Acting Quickly Can Matter

Enrollment offers in breach notices usually run for a stated period from the date of the letter, and the letter is the document that states it. The two-year negligence limitations period in section 16.003 is measured from events rather than from the day a letter is opened. Account and benefit statements that would show misuse are easiest to obtain close to the event. None of that is a reason to rush a decision, and it is a reason to have the notice looked at rather than filed away.

There is also the ordinary, practical point: the notice letter is the only document that states what happened to one specific person. Keeping the envelope, the letter and any enrollment code makes every later conversation, with a lawyer or with a reporting agency, a shorter one.

Sources

1. Office of the Attorney General of Texas, Data Security Breach Reports listing — the Amplifon (USA), Inc. entry recording 85,804 Texans affected, the Minneapolis address, the categories of information affected, that notice was provided to consumers, the methods of notice by website posting and U.S. Mail, and the November 6, 2026 publication date (primary source; searchable by entity name).
2. Texas Legislature, Texas Business and Commerce Code chapter 521, Identity Theft Enforcement and Protection Act — the breach-notification duty, the 60-day individual notice period, the 250-resident threshold and 30-day Attorney General reporting requirement, and the enforcement provisions (primary source).
3. Texas Legislature, Texas Business and Commerce Code chapter 20 — the security freeze available on a consumer file held by a consumer reporting agency (primary source).
4. Texas Legislature, Texas Civil Practice and Remedies Code section 16.003 — the two-year limitations period for negligence actions (primary source).
5. “Data breach at hearing aid giant Amplifon impacts thousands”, Jonathan Greig, The Record from Recorded Future News, November 9, 2026 — the 85,804 figure reported to Texas officials, the 1,027 figure reported to Vermont, the California filings, the February 11 discovery, the January 18 to February 8 access window, the data categories, the attribution of the 1,332,826 total to class action law firms, and the note that Amplifon did not confirm it.
6. “Amplifon Americas Data Breach Impacts 1.3 Million”, Ionut Arghire, SecurityWeek, November 9, 2026 — second independent account of the January 2026 intrusion, the January 18 to February 8 file copying, the eight-month review interval, the affected data categories including Social Security numbers and financial information for some individuals, the company statement that it is not aware of fraudulent use, and the 1,332,826 nationwide figure attributed to the Texas Attorney General filing material.
7. “Amplifon Americas Discloses Security Incident Affecting Patient and Member Data”, The Hearing Review, November 10, 2026 — third independent account, including the February 11, 2026 detection, the completion of the data review on October 6, 2026, the full list of affected data categories, the statement that potentially impacted individuals with a valid mailing address will be notified, the 24 months of credit monitoring and identity protection at no charge to certain individuals, and the relevance for providers in the Amplifon network.
8. “Data Breach Hits Operator of South Texas Nuclear Power Plant”, Brandon Lingle, San Antonio Express-News via Government Technology, October 30, 2026 — independent confirmation of the Texas reporting framework, including the 250-resident threshold, the 30-day Attorney General reporting deadline, the duty to notify affected consumers, and the one-year removal rule for listings.