What Happened to Xfinity 2023 Cyber Breach Settlement?
The Xfinity 2023 Cyber Breach Settlement resolves a class-action lawsuit against Comcast stemming from a data breach in October 2023 that exposed the personal information of approximately 35.8 million customers. Comcast agreed to a $117.5 million settlement fund, offering affected customers cash payments, reimbursement for documented losses, and three years of identity protection services. As of July 2026, claims are open, and payments have begun for some eligible individuals.
Quick Answer
The Xfinity 2023 Cyber Breach Settlement, resulting from a data breach affecting around 35.8 million customers in October 2023, has led to a $117.5 million agreement by Comcast. Eligible customers, those who received a breach notification in December 2023, can claim an estimated $50 cash payment or up to $10,000 for documented losses, plus three years of identity protection. The claim deadline is September 14, 2026, and a final approval hearing was rescheduled for August 5, 2026, though some payments reportedly began as of July 6, 2026.
📊Key Facts
📅Complete Timeline14 events
Citrix Announces Vulnerability
Citrix, an Xfinity software provider, announced a vulnerability (Citrix Bleed, CVE-2023-4966) in one of its products and released a patch.
Unauthorized Access to Xfinity Systems
Threat actors exploited the unpatched Citrix vulnerability to gain unauthorized access to Xfinity's internal systems, compromising customer data.
Xfinity Discovers Suspicious Activity
Xfinity detected suspicious activity within its internal systems, initiating an investigation into the security incident.
Data Acquisition Confirmed
Xfinity determined that customer information was likely acquired during the unauthorized access period.
Scope of Compromised Data Determined
Xfinity concluded that the compromised information included usernames, hashed passwords, and for some, names, contact info, partial SSNs, dates of birth, and security questions/answers.
Public Disclosure and Customer Notification
Comcast publicly disclosed the data breach and began notifying approximately 35.8 million affected Xfinity customers via email and website announcements.
First Class Action Lawsuit Filed
Kenneth Hasson filed the first complaint, initiating a series of class-action lawsuits against Comcast over the data breach.
Lawsuits Consolidated
Multiple lawsuits filed across various federal courts were consolidated into a single class action case, *Hasson v. Comcast Cable Communications, LLC*.
Preliminary Settlement Reached
Comcast agreed to a $117.5 million preliminary settlement to resolve the class-action litigation, which received preliminary court approval on January 22, 2026.
Official Settlement Website Goes Live
The court-approved settlement website, ComcastBreachSettlement.com, became active, allowing eligible class members to access information and prepare claims.
Opt-Out and Objection Deadline
The deadline for class members to exclude themselves from the settlement or object to its terms passed.
Settlement Payments Begin
Reports indicate that settlement payments began to be distributed to eligible claimants.
Rescheduled Final Approval Hearing
The court's final approval hearing for the settlement, originally set for July 7, 2026, was rescheduled to this date.
Claim Filing Deadline
The extended deadline for eligible Xfinity customers to submit their claims for compensation or identity protection services.
🔍Deep Dive Analysis
The Xfinity 2023 Cyber Breach originated from a critical vulnerability, dubbed 'Citrix Bleed' (CVE-2023-4966), in software provided by Citrix, a third-party vendor used by Xfinity. Although Citrix released a patch for this vulnerability on October 10, 2023, Xfinity's internal systems were accessed by unauthorized users between October 16 and October 19, 2023, before the patch was fully implemented.
Comcast discovered the suspicious activity on October 25, 2023, and by December 6, 2023, concluded that customer information had likely been acquired. The breach affected approximately 35.8 million to 36 million current and former Xfinity customers. The compromised data included usernames, hashed passwords, names, contact information, dates of birth, the last four digits of Social Security numbers, and security questions and answers for a subset of customers.
Following the public disclosure and customer notifications on or around December 18, 2023, multiple class-action lawsuits were filed against Comcast, alleging failure to adequately protect personal information and maintain sufficient data security. These lawsuits were consolidated into Hasson v. Comcast Cable Communications, LLC in the U.S. District Court for the Eastern District of Pennsylvania.
Comcast, while denying any wrongdoing, agreed to a preliminary settlement of $117.5 million in January 2026 to avoid the costs and risks of continued litigation. The settlement fund is designated to cover cash payments to eligible class members, reimbursement for documented out-of-pocket losses, and three years of identity defense services. The official settlement website went live in April 2026, and the deadline for class members to exclude themselves or object to the settlement was June 1, 2026.
The final approval hearing for the settlement was initially scheduled for July 7, 2026, but was later rescheduled to August 5, 2026. The deadline for eligible customers to file a claim for compensation was extended to September 14, 2026. As of July 6, 2026, some reports indicate that payments have already begun to be distributed to claimants. The settlement provides for an alternative cash payment of approximately $50 without proof of loss, or up to $10,000 for documented out-of-pocket expenses and lost time (at $30 per hour for up to five hours). Additionally, all eligible class members receive three years of identity protection services.
What If...?
Explore alternate histories. What if Xfinity 2023 Cyber Breach Settlement made different choices?