ENKR

Comcast Xfinity data breach

Add to my breach check

Made public · 35,879,455 people

What leaked6

Replaceable

  • Password
  • Security questions and answers

Hard to replace

  • Other profile data
  • Username

Permanent

  • Date of birth
  • Full name
  • Passwordhashed passwords
  • Security questions and answerssome customers
  • Date of birthsome customers
  • Full namesome customers
  • Other profile datalast four digits of the Social Security number, contact information · some customers

To-dos4 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover, recovery takeover
  3. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  4. Reset security questions and remove password hintsabout 15 minfreeStops: recovery takeover

What happened next11 events

  1. UndetectedNone on record
  2. Response 6 eventsNo individual notice on record · show events
  3. Remedy 2 eventsEnded · show events
  4. PenaltyNone on record
  5. Disputes 3 eventsSettled · show events
  1. Settlement claims · deadline moved from August 14, 2026Closed
  2. Final approval of the class settlement; attorneys' fees of 31,725,000 USD, 27% of a 117.5 million USD fund
  3. Preliminary approval of the class settlement
  4. Offered up to 10,000 USD per person for documented losses and lost time, or a 50 USD cash payment, and free credit monitoring for all class members
  5. Class action filed in the Eastern District of Pennsylvania; later the master case for consolidated suits against Comcast and Citrix
6 more
  1. Required password resets at next login and urged two-factor authentication
  2. Notified affected customers about two months after the intrusion
  3. Concluded that usernames and hashed passwords were taken, plus other details for some customers
  4. Filing with the Maine attorney general listed 35,879,455 affected individuals
  5. Investigation determined that information was likely acquired; federal law enforcement notified
  6. Patched and applied Citrix's mitigation guidance · issued October 23, 2023; the intrusion had already happened on October 16, 2023 to 10-19
Company
Comcast
When it happened
–
Made public
Notice
Leak confirmed
Affected
35,879,455 people · Comcast's filing with the Maine attorney general, as reported; about 31.7 million potential class members in the 2026 settlement

Sources