Comcast Data Breach Lawsuit: The $117.5 Million Xfinity Settlement

The Breach

In October 2023, Comcast’s Xfinity was hit by a cyberattack that exploited a vulnerability in third-party software the company used, and it disclosed the incident that December. The breach affected an estimated 35.9 million current and former Xfinity customers, exposing personal information that, depending on the customer, could include names, contact details, portions of Social Security numbers, dates of birth and secret questions and answers used for account security. Data like partial Social Security numbers and security-question answers is exactly what fraudsters use to impersonate people or break into other accounts.

The scale — tens of millions of customers — put it among the larger breaches of the period.

The Settlement

Comcast agreed to a $117.5 million class-action settlement, given preliminary approval, to resolve consolidated claims that it failed to adequately protect customer data. Class members — affected Xfinity customers — can claim reimbursement of up to $10,000 for documented out-of-pocket losses tied to the breach, payment for lost time, and access to identity-protection and credit-monitoring services, with a smaller flat cash option as well. Comcast did not admit wrongdoing. The claims process runs through the official settlement administrator, with a filing deadline set in 2026.

As with most breach settlements, the biggest payouts require documentation of actual losses linked to the breach.

What Customers Should Know

If you were an Xfinity customer, check for official notice and file through the settlement administrator before the deadline — never through a site that charges a fee. Because security-question answers may have been exposed, change them (and any reused passwords), and consider a credit freeze given the partial Social Security numbers involved. Watch for phishing that references your Xfinity account.