Comcast

Summary

Comcast experienced a cyberattack that exploited a Citrix vulnerability, leading to unauthorized access to customer systems and the exposure of personal data including usernames, passwords, names, contact information, dates of birth, the last four digits of Social Security numbers and security‑question answers. The company later disclosed the breach and agreed to a $117.5 million class‑action settlement that creates a fund for affected individuals. Eligible claimants may receive a flat payment of about $50 or seek reimbursement of up to $10 000 for documented losses such as identity‑theft expenses, with the remainder of the fund covering identity‑protection services, administrative costs and attorneys’ fees. The settlement resolves claims that the company failed to adequately protect customer data while denying any wrongdoing.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Between October 16 and October 19 2023 cybercriminals exploited the “Citrix Bleed” vulnerability in the Citrix NetScaler appliance that Comcast used to manage remote access for customers and contractors, gaining unauthorized access to Comcast’s internal systems. The intrusion was first detected during a routine cybersecurity exercise on October 25 2023, after which Comcast notified federal law enforcement and began an investigation. Comcast did not inform affected customers of the breach until December 18 2023, approximately two months after the initial intrusion, at which point it disclosed that usernames, hashed passwords, contact details, dates of birth and the last four digits of Social Security numbers had likely been acquired. For some individuals the exposed data also included full Social Security numbers, driver’s license numbers, secret questions and answers, and security‑question responses.

The breach prompted a class‑action lawsuit filed in the U.S. District Court for the Eastern District of Pennsylvania, alleging that Comcast failed to timely patch the Citrix vulnerability and inadequately protected customer data, thereby exposing class members to identity theft, fraud and further injury. The case spanned roughly two years from filing to resolution, with the court issuing a preliminary approval of a settlement in January 2026 and a final approval hearing scheduled for July 7 2026 (also noted as August 5 2026 in other filings). Judge John Younge approved a $117.5 million settlement funded entirely by Comcast, noting the litigation’s complexity due to novel claims under the federal Cable Communications Policy Act and contested factual issues such as the sensitivity of the last four digits of Social Security numbers and whether the compromised data appeared on the dark web. The settlement class comprises approximately 31.7 million to 36 million individuals who received a breach notification from Comcast in December 2023 and used Comcast services during the October 2023 incident. Under the agreement, claimants may seek reimbursement of up to $10,000 for documented out‑of‑pocket losses and lost time, alternatively elect a flat cash payment of about $50, and receive a free subscription to a credit monitoring service; additional compensation for time spent addressing identity‑theft‑related matters is available at a rate of $30 per hour, up to five hours, or up to $150 for preventative measures. Attorneys’ fees were approved at $31.7 million (27 % of the fund), though plaintiffs’ counsel had sought up to one‑third of the settlement (~$39 million) in other filings. The deadline to submit claims was initially August 14 2026 and later extended to September 14 2026.

As part of the settlement Comcast is required to provide identity defense services to all affected class members for three years, a benefit available even to those who do not file a monetary claim. The company also paid administrative and notice costs capped at $7.3 million and agreed to release both Comcast and Citrix from all class claims related to the breach. The settlement resolves claims that compromised personal information created a substantial risk of identity theft and fraud, and it provides affected consumers with a mechanism to recover documented losses, receive modest cash payments, and obtain credit‑monitoring and identity‑protection services. No further legal action against Comcast concerning this specific breach may be pursued by class members who accept the settlement or fail to opt out by the prescribed deadline.

Sources

Sources available to members: 8 sources.