“How quickly can you connect the files an attacker took to the people whose information was inside them? Stopping unauthorized access and determining who needs to be notified are separate tasks. A response plan needs to account for both. In Amplifon’s case, the company says it needed eight months just to review the stolen files and confirm whose personal information was actually inside them, which tells you the real bottleneck wasn’t detection, it was data review at scale. Which is fair, they indicate that they have 80 million customers, that's a lot of records. Still, 8 months is a long time.

“What makes this breach worth paying close attention to is the sheer range of what was taken. This isn’t a password-reset situation. The stolen data includes names, driver’s license numbers, dates of birth, hearing and medical information, dates of service and other health details, health insurance information, and for some individuals, Social Security numbers and financial information. Each piece of that adds its own risk.

“A driver’s license number is enough to open accounts or pass identity checks that rely on government ID. Medical and insurance information enables medical identity theft, where someone else’s treatment or prescriptions end up tied to your insurance file, something that can take months to untangle and can actually affect your own medical record. And health details make social engineering far more convincing. A caller who knows your hearing provider, your treatment dates, or your insurance plan will not sound like a stranger phishing for information. They will sound like someone from your own healthcare network. That’s a fundamentally different threat than a stolen email address, and it deserves a fundamentally different warning than ‘monitor your accounts.’ Vendors should be held accountable for that kind of broad data breach.

“We do not know what caused the delay at Amplifon, though I would guess it has to do with where the data resides. If it takes eight-months to review the data in the U.S. subsidiary of Amplifon, I'm wondering why so long? Other organizations should decide in advance how they will communicate when an investigation is still underway. If they know certain patient information was stolen but are still determining the full scope, you want to know who on your team decides whether to issue an initial warning or not. You don't want to call a meeting to find out if it's the CTO, the Chief Risk Officer, or someone else. Needing to call a meeting causes a delay. You also want to know what you can accurately tell those patients now, and what will need a later update. Patients need clear information they can act on, and the response plan should establish how to provide it before every part of the investigation is finished. A data breach tabletop would have brought those gaps to the attention of the CISO and CIO/CTO.

“For patients affected by this specific breach: if your notice mentions a Social Security number, place a credit freeze with all three bureaus, not just a fraud alert. If it mentions medical or insurance information, request an accounting of disclosures from your health plan and watch your explanation-of-benefits statements for care you didn’t receive. If it mentions a driver’s license number, contact your state DMV to ask about a fraud flag on your record. Going forward, you want to treat any unsolicited call referencing your hearing care, your provider, or your treatment history as a reason to hang up and call the organization back directly, not a reason to trust the caller.

“For organizations handling this kind of data what you need to do is know, today, not after an incident, how long a full data review would take if you had to run one. Then build your notification plan around the worst case, not the best one.”