A medical data breach has struck the American subsidiary of an international hearing aid group, which is now notifying its customers. According to The Record (Recorded Future News), in a November 9, 2026 article, the breach dates back to early this year.
Key points
- According to The Record, a hearing aid company is notifying its US customers after a breach exposed health information.
- The incident took place in the United States, not in Canada, but this scenario can affect any Canadian SMB that holds health data.
- In Quebec, Law 25 requires organizations to log privacy incidents in a register and, depending on severity, to notify the Commission d’accès à l’information (Quebec’s privacy regulator) as well as the people affected.
What We Know About the Incident
According to The Record (Recorded Future News), in a November 9, 2026 article, the US division of an international hearing aid group is notifying customers of a breach that occurred earlier this year. The incident took place in the United States. The information involved includes medical records, and the report points to thousands of people affected.
The sector involved is hearing aids and audiology, a hands-on service business not unlike a local clinic or specialty retailer here. The source does not specify the cause of the breach, the exact categories of information involved, or whether any Canadian residents are among those notified. We are sticking to what has been confirmed.
A prevention scenario worth keeping in mind: legitimate access to the system holding customer records falls into the wrong hands, for instance after a phishing email or a reused password. Data is then copied quietly, and the discovery can come weeks or months later. Nothing indicates that the reported incident unfolded this way.
A Medical Data Breach Costs Trust, Not Just IT Budget
Health information cannot be replaced like a credit card. Once it is exposed, the customer’s first question is whether they can still trust the business with their file. That hesitation, repeated across hundreds of customers, is what weighs most heavily on revenue.
Many Quebec SMBs collect medical information without realizing it: an intake form, a follow-up note, a doctor’s referral attached to a sales file. A care practice, an equipment distributor, or an employer managing group insurance claims are all exposed to this.
We’ll say it plainly: there is no absolute protection, and no provider can guarantee zero risk. The realistic goal is to meaningfully reduce exposure, by knowing where sensitive data lives and limiting how many people can access it.
Checks to Run This Week
These checks are a management responsibility, done with support from your IT provider. How long they take depends on your company’s size and the number of systems involved. They answer one very concrete question: if your customer files leaked tomorrow, would you know which ones, how many people, and who to notify?
List where your business keeps health or insurance records, including email inboxes and spreadsheets. Ask your IT provider who currently has access to those records, then remove accounts belonging to former employees or former vendors. Turn on two-factor authentication for email and customer management software, starting with accounting and management. Open a privacy incident register that complies with Law 25, and designate the person responsible for the protection of personal information.
FAQ
Does Law 25 apply if I keep health information about my customers?
Yes, as soon as your business operates in Quebec and holds this kind of information. The law requires you to designate a person responsible for the protection of personal information and to maintain the privacy incident register. When an incident poses a risk of serious harm, the duty to notify covers both the Commission d’accès à l’information and the people affected. The sensitivity of the data factors into that assessment, but it alone isn’t enough to conclude the threshold has been met: it’s evaluated case by case.
Does an incident that happened in the United States actually concern me?
The location changes the legal framework, not the mechanism. The case reported by The Record occurred in the United States, and Quebec’s obligations don’t apply there. That said, a shop in Trois-Rivières or a clinic in Laval keeps the same kind of records, often in identical software. The scenario still applies here, with one difference: Law 25 governs how you have to respond.
My business is small, am I too low-profile to interest an attacker?
No, and that assumption is costly. The Canadian Centre for Cyber Security notes that all Canadian organizations are exposed, regardless of size. A small organization often has less monitoring in place, which can make it an easy, low-effort target for anyone after records they can sell.
Sources
- The Record (Recorded Future News) · press, November 9, 2026
- Commission d’accès à l’information du Québec · obligations, incident register and notification
- Centre canadien pour la cybersécurité : contrôles de cybersécurité de base pour les petites et moyennes organisations · baseline checklist
Source: The Record (Recorded Future News) · https://therecord.media/amplifon-hearing-aid-company-data-breach
This article was prepared by RISS Canada’s monitoring team based on the public sources cited above, with the assistance of AI tools, then reviewed according to our editorial policy.
