Quick Answer: Comcast Xfinity Data Breach Settlement
If you received a notice that your Xfinity data was exposed in the October 16–19, 2023 breach, you have until September 14, 2026 to file a claim in the $117.5 million Comcast Xfinity data breach settlement. Eligible class members can choose between a flat $50 cash payment with no documentation required, or up to $10,000 for documented out-of-pocket losses, plus three years of free identity protection. The claim form is at comcastbreachsettlement.com, and you need your Class Member ID from the breach notice to file.
What Happened in the Xfinity Data Breach
Between October 16 and October 19, 2023, attackers exploited the Citrix Bleed vulnerability (CVE-2023-4966) in Citrix NetScaler ADC and NetScaler Gateway appliances used by Xfinity to gain unauthorized access to internal systems and customer data. Comcast publicly disclosed the breach on December 18, 2023, and sent individual notifications to approximately 36 million current and former Xfinity customers across the United States. The exposed data included names, contact information, dates of birth, the last four digits of Social Security numbers, and account credentials. Full credit card numbers were stored in a separate system and were not compromised.
Settlement at a Glance
| Detail | Information |
|---|---|
| Settlement fund | $117.5 million |
| Case | Hasson v. Comcast Cable Communications, LLC, Case No. 2:23-cv-05039-JMY (E.D. Pa.); also MDL No. 3127 |
| Breach date | October 16–19, 2023 |
| Customers affected | Approximately 36 million |
| Claim deadline | September 14, 2026 (extended) |
| Final approval hearing | August 5, 2026 (rescheduled) |
| Court | U.S. District Court for the Eastern District of Pennsylvania |
Who Qualifies for a Payment
You are a class member if you are a current or former Xfinity customer and received a notice around December 18, 2023 that your personal information was exposed. You do not need to prove damages to receive the $50 flat payment, but you do need your Class Member ID from the notice letter. If you cannot locate your notice, contact the settlement administrator through the official settlement website.
How Much You Can Claim
The settlement offers two benefit tiers:
- Tier 1 — $50 flat cash: No documentation required. You only need to confirm your identity using the Class Member ID.
- Tier 2 — Up to $10,000: Reimbursement for documented out-of-pocket losses tied to the breach, including credit monitoring fees, identity theft expenses, professional fees, and up to four hours of documented time spent addressing the breach at $25 per hour.
- Identity protection (all class members): Three years of free identity protection services regardless of which tier you select.
How to File Your Claim
- Visit comcastbreachsettlement.com.
- Click Submit a Claim and enter your Class Member ID from the December 2023 notice.
- Choose Tier 1 ($50) or Tier 2 (up to $10,000).
- If you selected Tier 2, upload supporting documentation (receipts, statements, time logs).
- Submit online by 11:59 PM ET on September 14, 2026, or mail your form postmarked by that date.
You can also file by mail using the PDF claim form available on the settlement website. Mail the completed form to the settlement administrator address printed on the form. Allow extra time for postal delivery — postmark dates are strictly enforced.
What to Do If You Missed the Claim Deadline
If the September 14 deadline has passed by the time you read this, your options are limited. You will not receive a cash payment, but you remain a class member unless you timely opted out by July 1, 2026. As a class member, you give up the right to sue Comcast separately about the data incident. To preserve your right to sue, you must have submitted a written Request for Exclusion postmarked by July 1, 2026 — that deadline has also passed.
If you suffered significant identity theft losses tied to the breach, consult a consumer-protection attorney about your individual options. The settlement does not prevent you from seeking additional compensation for unreimbursed losses through separate legal channels.
Status and What to Expect Next
The Final Approval Hearing was held on August 5, 2026 at 12:30 PM ET in the U.S. District Court for the Eastern District of Pennsylvania (James A. Byrne U.S. Courthouse, Philadelphia). As of late August 2026, no final approval order had been publicly filed. Cash payments are typically distributed four to ten months after the claim deadline once final approval is granted and any appeals are resolved. Credit monitoring enrollment is automatic — class members do not need to file a claim to receive identity protection benefits.
For broader guidance on what to do after any data breach — including credit freezes, fraud alerts, and tax-fraud protection — see our complete guide to data breach insurance and response, or our guide to cybersecurity insurance for individuals and small businesses. If you work in IT, security, or compliance, the TutorsBot Governance, Risk & Compliance course covers breach response, regulatory frameworks, and tabletop exercises that translate directly to faster recovery.
