The original text is in EN, taken from the source site. Source ↗

WS Audiology (WSA), the parent company of Widex and Signia, is investigating unauthorized access to its internal IT infrastructure after taking selected systems offline to contain a cybersecurity incident.

The disruption affected customer applications and professional services, although the company said hearing aids themselves remained unaffected. Its October 30 update described a phased restoration coordinated with global IT partners.

The publicly available statement confirms access to “certain IT systems,” but does not specifically identify a compromised customer relationship management (CRM) platform.

The precise scope of the intrusion, including affected databases and any exposure of customer records, therefore remains unconfirmed. That distinction separates verified operational disruption from broader claims about the attackers’ access.

WSA said its business operations and core services continued, with interruptions resulting from precautionary shutdowns.

Technical teams disconnected both internal and customer-facing systems while investigating, then began restoring services in a prioritized sequence.

The company attributed the incident to its own IT environment rather than a security flaw in its cloud-based hearing software.

Widex Compass Cloud, used by hearing care professionals for fitting and fine-tuning, was taken offline proactively and had returned to full functionality by the October 30 update.

WSA said professionals could again fit Widex Allure and Allure AI devices normally. A spokesperson emphasized that Compass Cloud was disconnected for containment, not because it had stopped functioning.

The Widex MOMENT application experienced the most significant consumer-facing disruption. WSA expected restoration over the October 31–November 1 weekend, while Signia TeleCare was scheduled to return early the following week.

HearingTracker Researchers said that, recovery targets announced on October 30, not confirmation that either service subsequently resumed. Standard Signia fitting and fine-tuning remained available despite the TeleCare outage.

This indicates a partial interruption across its digital environment rather than a complete suspension of commercial operations.

Although amplification continued, some MOMENT users lost access to preferred listening programs and app-based controls.

WSA also reported that all e-commerce siteswere functional and that current orders continued to be processed and shipped.

In a HearingTracker forum discussion, a teacher reported being unable to select a classroom preset.

Other participants described server communication errors, illustrating how unavailable supporting services can restrict personalization without disabling the underlying medical device.

Some iPhone users reported retaining limited program access through Apple’s built-in hearing-device settings.

These accounts describe individual experiences, not a universally validated workaround. The reports also do not establish the intrusion’s technical cause or prove that hearing aids were compromised.

The latest incident follows a separate WSA breach identified on July 5, 2024. That intrusion affected Bloomhearing’s local retail IT system in Australia and New Zealand, including data associated with Hong Kong and Singapore.

WSA confirmed temporary unauthorized access to patient and employee information and said attackers might have copied data, although backups prevented data loss. Other WSA systems were unaffected.

The sector has also suffered substantial ransomware-related disruption. Demant’s 2019 annual report documented a DKK 550 million negative operating-profit impact after insurance from an attack that forced widespread IT shutdowns.

That precedent demonstrates potential consequences, but does not establish ransomware involvement at WSA.

Its October 30 disclosure identified no attacker, malware family, initial-access method, or confirmed data exfiltration; those remain unresolved questions.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.