How The Breach Happened

The underlying breach occurred between Oct. 16 and Oct. 19, 2023, when attackers exploited an unpatched vulnerability in Citrix NetScaler products known as Citrix Bleed, cataloged as CVE-2023-4966. Citrix had released a fix on Oct. 10, 2023, five days before the intrusion began. According to Comcast's breach notification filed with the Maine Attorney General's office and reported by The Verge, the company did not fully implement the patch in time. Intruders used the flaw to hijack authenticated sessions and extract customer records.

The compromised data varied by customer. For most of the nearly 36 million people listed in the Maine filing, attackers obtained usernames and hashed passwords. For a subset, the exposure also included names, contact information, the last four digits of Social Security numbers, dates of birth and answers to security questions. The combination matters more than any single field. A hashed password is not a cleartext credential on its own. Paired with a known username, a birthdate and a correct answer to “What is your mother's maiden name?” it gives an attacker nearly everything needed to reset accounts elsewhere. That is the kind of credential-stuffing and account-takeover risk Citrix Bleed enabled downstream.

Comcast publicly disclosed the breach on Dec. 18, 2023, roughly two months after the intrusion. The company told reporters at the time that it was "not aware of any customer data being leaked anywhere, nor of any attacks on our customers." Researchers at Mandiant, Google's incident response firm, had by then already documented Citrix Bleed being weaponized by affiliates of the LockBit and Medusa ransomware groups against other targets. No public evidence ties either group to the Xfinity intrusion specifically.

What You Can Claim

Under the settlement, eligible class members are U.S. residents who received a Comcast breach notice on or around Dec. 18, 2023. They have four benefits to choose from. The first is an alternative cash payment of roughly $50 with no documentation, subject to pro-rata adjustment based on total claims filed. The second is reimbursement of up to $10,000 for documented out-of-pocket losses tied to the breach, including credit monitoring fees, credit freeze and unfreeze charges, identity theft insurance, postage and any unreimbursed fraudulent charges or falsified tax returns. The third is lost time at $30 per hour for up to five hours, capped at $150 and counted against the $10,000 ceiling. The fourth applies to everyone in the class whether they file or not: three years of CyEx Financial Shield identity monitoring with $1 million in identity theft insurance. Enrollment codes shipped with the original breach notice.

The $117.5 million fund will be reduced by up to roughly $39.2 million in attorneys’ fees, about $7.3 million in administration costs and service awards of $5,000 for each of the 11 class representatives. The remainder is what claimants split.

Deadlines And How To File

Three dates matter. The opt-out and objection deadline is June 1, 2026. The final approval hearing is scheduled for July 7, 2026 at 10 a.m. ET in Philadelphia. The claim filing deadline is Aug. 14, 2026. Class members who do nothing will give up their right to sue Comcast over the breach but will still receive the automatic identity monitoring.

Current and former Xfinity customers who believe they were affected but did not receive a notice can submit an ID Look Up Form through the official settlement site, administered by Kroll Settlement Administration. Claims can be filed online using the class member ID from the December 2023 notice or by mail postmarked no later than Aug. 14, 2026 to Hasson v. Comcast Cable Communications LLC, c/o Kroll Settlement Administration LLC, P.O. Box 5324, New York, NY 10150-5324.

Anyone whose partial Social Security number, date of birth and security-question answers were exposed should assume those identifiers are in criminal circulation and act accordingly. A credit freeze with Equifax, Experian and TransUnion is free, takes a few minutes and blocks new accounts from being opened in your name. It is a stronger protection than identity monitoring alone, which only alerts you after misuse has already happened.

Expect phishing. Settlements of this size reliably produce a wave of fake claim-assistance emails, spoofed settlement sites and phone calls demanding upfront fees. Kroll is the real administrator. The real site is comcastbreachsettlement.com. There is no fee to file a claim. No legitimate party will call and ask for your Social Security number or bank account to verify your eligibility.