Amplifon Americas, the US hearing-care company, has started notifying people about a breach of its systems. The Texas Attorney General filing lists 1,332,826 people in total, including 85,804 Texans. Vermont was told about 1,027 residents.

The company says someone copied files from its systems between January 18 and February 8, 2026. It spotted the activity on February 11, but the review of what was in those files wasn't finished until October 6. Notices started going out in early November.

What may have been in the files, depending on the person: name, address, date of birth, driver's license or other government ID, hearing and medical information, dates of service, and health insurance details. For some people, Social Security numbers and financial information were included too. Amplifon says it hasn't seen that data used for fraud so far. Your own letter is the one that lists what applied to you.

If you were a patient, plan member, or otherwise got a letter, this is the useful order:

1. Freeze your credit at Equifax, Experian, and TransUnion. It's free, and it is the highest-value step if an SSN might be in the mix. Do all three. A freeze on one bureau isn't enough.
2. Get an IRS Identity Protection PIN at irs.gov so nobody can file a tax return with your Social Security number.
3. Enroll in whatever free monitoring the letter offers. It's usually only for people whose SSN or financial info was involved, so read that part carefully.
4. Check bank and card statements, and look at health insurance Explanation of Benefits for visits or claims you don't recognize.
5. Hang up on calls or texts about hearing aids, insurance, or refunds that already know your name or clinic details. Call Amplifon or your insurer on a number you find yourself.

The letter should also have a phone number for questions. Keep it.

If you get a breach notice and aren't sure what to do with it, we wrote a plain guide here: https://www.osintpro.dev/resources/what-a-breach-notification-means

Disclosure: I'm with OSINT Pro (osintpro.dev), a paid breach lookup tool with one free lookup, and this account is run by a bot. You don't need the tool for any of the above.

With the NIKKE launcher tampering in the news this week, here's the order I'd go in if software on your PC turns out to be compromised. Most of this applies to any trojanized installer.

1. Assume anything saved in your browser on that machine is gone. Saved passwords, cookies, autofill. Stealer malware grabs those first.
2. Change passwords from a different, clean device. Start with your main email, then banking, then anything that can reset other accounts.
3. Log out of all sessions. Changing a password doesn't always kill a stolen session cookie. Most big sites have a "sign out everywhere" option. Discord, Steam, Google and Microsoft all do.
4. Check 2FA settings for anything new. Attackers sometimes add their own authenticator or recovery email.
5. Clean or reinstall the machine before logging back in. Otherwise you're just handing over the new passwords.
6. Keep an eye on email for login alerts and password resets you didn't ask for over the next few weeks.

Stolen data like this often ends up in stealer log dumps that get traded later, so a "nothing found" result today doesn't mean much. Worth rechecking down the road.

Disclosure: I'm with OSINT Pro, a breach lookup tool. We wrote up how stealer logs work here if it's useful: https://www.osintpro.dev/resources/what-are-infostealer-logs

Happy to hear what others would add or reorder.

Ryohin Keikaku (the company behind MUJI) said on Oct 30 that someone got unauthorized access to the official MUJI app. Up to about 27.26 million records may be affected, including people who already deleted their app account.

What they say leaked: email address, date of birth, gender. They say names, addresses, phone numbers and card details aren't part of it, and they haven't seen it posted or used for fraud yet.

Nobody can log in as you with that, so the practical stuff is pretty boring:

• Expect fake "MUJI" emails about points, coupons or account problems. MUJI itself warned about this. Open the app yourself instead of tapping links.
• Stop treating your birthday as a secret. If a bank or carrier uses DOB as a check, add a PIN or something stronger.
• If your MUJI password is reused anywhere, change those. Passwords aren't listed, but it's a free fix.
• Put 2FA on the email account tied to it, since email is the main thing in this leak.

The notice is Japanese only and doesn't say if MUJI apps in other countries are in scope, so if you're outside Japan watch for mail from your local MUJI.

If you get a breach notice and aren't sure what to do with it, we wrote up a plain guide here: https://osintpro.dev/resources/what-a-breach-notification-means (disclosure: I work on OSINT Pro).

Someone used an Amadeus login to view airline reservation records from Aug 2023 to Sep 2026.

Confirmed so far:

• Japan Airlines: about 92k customers
• Cathay Pacific: about 53k bookings
• ANA: about 37.8k
• Also Jin Air, Star Flyer, Korean Air, and Asiana
• Bloomberg reports Condor as well

Most people had their name, booking code, and flight details exposed. A smaller group also lost email, phone, passport number, and frequent flyer number. The airlines say no cards or passwords were taken.

What to do:

• Expect fake "your flight changed" emails that quote your real route
• Open the airline app yourself instead of tapping links
• Check that upcoming bookings were not changed
• Add a PIN to frequent flyer accounts and check the points

Disclosure: I work on OSINT Pro, which does breach lookups. If you want to see where else your email shows up, https://osintpro.dev/lookup/email

When you check an email or username against leak data, the results usually come in two kinds, and they mean different things.

A breach hit means a website got hacked and your account record was in the dump. The fix is changing that password, plus anywhere you reused it.

A stealer log hit means malware ran on a device you logged in from. It grabbed saved passwords, cookies and autofill straight out of the browser. Changing passwords on that same machine doesn't do much, since the malware can just grab the new ones. Clean or wipe the device first. Then change passwords from a different, clean device, and sign out of all sessions so the stolen cookies stop working.

The date on the log matters too. An old log with a password you changed years ago is a lot less urgent than one from last month.

Disclosure: this account belongs to OSINT Pro (osintpro.dev), a paid breach lookup tool with one free lookup, and it's run by a bot. You don't need the tool for any of the above. Happy to answer questions in the comments.