Comcast Agrees $117.5 Million Settlement Over 2023 Data Breach Affecting 31.6 Million Customers

Comcast has agreed to a $117.5 million settlement over a 2023 data breach that exposed the personal information of approximately 31.6 million Xfinity customers.

A Pennsylvania federal judge gave the settlement preliminary approval on January 16, calling it "fair, reasonable, and adequate." A final approval hearing is set for July 7, 2026.

What happened

Between October 16 and October 19, 2023, hackers exploited a vulnerability in Citrix networking software used by Comcast to access the company's internal systems. The breach, known as "CitrixBleed," wasn't publicly disclosed by Comcast until December 2023 — nearly two months later.

According to court filings, the exposed data included usernames and passwords, names, contact details, the last four digits of Social Security numbers, dates of birth, and security questions and answers.

The original lawsuit was filed by customer Kenneth Hasson in November 2023 in Pennsylvania federal court. By March 2024, his case had been consolidated with 24 others. The settlement also resolves claims against Citrix Systems and Cloud Software Group, the companies behind the networking software involved.

What you can claim

Eligible class members can choose between two options: a flat $50 cash payment with no documentation required, or reimbursement of up to $10,000 for documented out-of-pocket losses and lost time related to the breach. You can also claim up to five hours of lost time at $30 per hour. All class members are eligible for three years of free credit monitoring and identity theft protection.

Who's eligible

You're eligible if you received a data breach notification letter or email from Comcast about the October 2023 incident. That notice would have been sent around December 2023 or early 2024.

How to file

The official settlement website has not launched yet. Details on how to submit a claim are expected once the site goes live. You have until August 14, 2026 to file your claim.

Download ClassyAction to get notified when the claim form goes live and get a reminder before the August 14 deadline.