Comcast Settles 2023 Data Breach for $117.5 Million as Customer Claims Open

2026-04-17 companies

Philadelphia, Friday, 17 April 2026.
Millions of affected Xfinity users can now claim up to $10,000 for out-of-pocket losses, highlighting the escalating financial liabilities companies face over digital vulnerabilities.

The Anatomy of the Cyberattack and Legal Fallout

The origins of the liability trace back to a concentrated cybersecurity incident that occurred between October 16 and October 19, 2023 [1]. Malicious actors exploited a vulnerability within cloud computing software provided by Citrix, infiltrating the systems of Comcast’s Xfinity service [1][8]. The breach compromised the sensitive data of approximately 35.8 million to 36 million customers [1][4]. The exfiltrated information included usernames, hashed passwords, contact details, dates of birth, security questions and answers, and the last four digits of Social Security numbers [1][4]. Comcast formally disclosed the incident to affected users in mid-December 2023, issuing notification letters around December 18 [1][6].

Financial Implications and the Claims Process

To execute the resolution, a dedicated claims portal went live on April 14, 2026, allowing eligible individuals to seek restitution [1]. Of the total settlement fund, a significant portion—$39.2 million, or approximately 33.362 percent—is earmarked to cover the plaintiffs’ attorneys’ fees [4][7]. The remainder of the capital will be distributed among qualifying claimants who lived in the United States or its territories and utilized Comcast services during the October 2023 breach window [4][8]. Claimants must possess a unique Class Member ID, which the settlement administrator recently distributed via email, to initiate the filing process [1][2].

Critical Deadlines and Corporate Takeaways

Navigating the settlement requires strict adherence to upcoming legal deadlines. Customers wishing to participate and receive compensation must submit their claims online or via mail by August 14, 2026 [1][2]. Conversely, individuals who prefer to retain their right to pursue independent legal action against Comcast, or those who wish to formally object to the settlement terms, face an earlier deadline of June 1, 2026 [6][8]. A final approval hearing is scheduled for July 7, 2026, during which a judge will determine whether to authorize the settlement [2][6]. If approved without subsequent appeals, the distribution of funds will commence shortly thereafter [4][8].

Sources

Cybersecurity Data breach