Comcast Proposes $117.5M Settlement for Xfinity Data Breach

Comcast has reached a proposed $117.5 million class action settlement to resolve claims stemming from a major data breach that exposed the personal information of more than 31 million Xfinity customers in October 2023. The agreement, filed in the U.S. District Court for the Eastern District of Pennsylvania, awaits final approval at a hearing scheduled for July 7, 2026, in Philadelphia.

The breach occurred between October 16 and 19, 2023, when unauthorized actors exploited a vulnerability in Citrix software used by Comcast's systems. Despite the company applying a patch after Citrix's October 10 announcement, attackers gained access to internal networks. Comcast notified affected customers around December 18, 2023, stating that the stolen data included usernames and hashed passwords for all impacted individuals, along with names, contact information, dates of birth, the last four digits of Social Security numbers, and account recovery answers for some. No financial account details or full Social Security numbers were compromised, according to the company's disclosures.

The lawsuit, known as Hasson v. Comcast Cable Communications LLC, accused the company of failing to implement...