Comcast Xfinity Hacked, exposing nearly ALL customer’s data
By Eric Buhrendorf ·
Updated October 2026: We added what happened after the Xfinity breach, including federal warnings about Citrix Bleed and Comcast’s $117.5 million class action settlement, plus current steps for businesses that use remote access appliances.
According to CBS News and other outlets on Dec 19th, Comcast owned Xfinity was subject to a data breach known as “Citrix Bleed”
A filing in Maine’s attorney general’s office by Comcast claims that between October 16 and October 19 of this year, 35.8 million people we’re vulnerable to a data breach that revealed their customer data. This data included their names, contact information, account usernames and passwords, birthdates, parts of their social security numbers and answers to their security questions. The media and technology company notified their customers on Monday via email, with a notice on their website and media coverage.
This incident traces back to a vulnerability in Citrix software, which was announced on October 10, 2023. This software was not only used by Xfinity but also by thousands of other companies globally. Following Citrix’s issue of additional mitigation guidance on October 23, Xfinity promptly patched this vulnerability within its systems. However, during a routine cybersecurity check on October 25, Xfinity discovered suspicious activities. It was later determined that there had been unauthorized access to their internal systems between October 16 and October 19, 2023, as a result of this vulnerability.
In response to this discovery, Xfinity notified federal law enforcement and initiated a thorough investigation into the breach. By November 16, it became apparent that customer information had likely been acquired. Further analysis, completed by December 6, revealed that the data compromised included usernames and hashed passwords. Additionally, for some customers, other sensitive information such as names, contact information, the last four digits of social security numbers, dates of birth, and answers to security questions may have been exposed. The company is continuing its analysis of the affected data to understand the full scope of the breach.
As a precautionary measure, Xfinity has required all its customers to reset their passwords. EVERNET strongly recommends the use of two-factor or multi-factor authentication for all accounts, a security step that can help protect your accounts even in the event of a data breach. Also the practice of reusing passwords can leave more of your accounts vulnerable to attack, at EVERNET we can help implement a corporate password manager that can help store and create unique passwords as well as multi-factor authentication.
For customers seeking further information or assistance, Xfinity has established a dedicated call center that operates 24/7. The company remains steadfast in its commitment to protecting customer information, acknowledging the trust that customers have placed in them. Xfinity assures continued investment in advanced technology, effective protocols, and expert personnel dedicated to enhancing data security and protecting against such incidents in the future. If your business was affected by this Xfinity Citrix Bleed data breach, speak to one of our IT & Cybersecurity experts by clicking here.
The Xfinity data breach serves as a reminder of the ever-present need for robust cybersecurity measures and the importance of quick, transparent, and effective responses in the event of such incidents.
What happened next
Comcast was one of many victims. In November 2023, CISA, the FBI, MS-ISAC and Australia’s cyber security centre issued a joint advisory on LockBit 3.0 affiliates exploiting Citrix Bleed (CVE-2023-4966). The flaw let attackers take over valid user sessions on NetScaler ADC and Gateway appliances. The agencies told organizations to isolate and patch affected appliances quickly, rotate credentials and treat any exposed device as possibly compromised.
Customers sued. Comcast agreed to a $117.5 million settlement in the U.S. District Court for the Eastern District of Pennsylvania covering about 31.7 million people. Judge John Younge granted preliminary approval in January 2026 and final approval in August 2026. Class members can claim up to $10,000 for documented losses and lost time, or a $50 cash payment, plus credit monitoring. Court filings showed that some customers also had full Social Security numbers and driver’s license numbers exposed, according to Insurance Journal’s report on the settlement approval.
Citrix appliances stayed a target. In June 2025 a similar memory overread flaw, nicknamed “CitrixBleed 2” (CVE-2025-5777), was found in NetScaler Gateway and AAA configurations. CISA added it to its Known Exploited Vulnerabilities catalog on July 10, 2025 and gave federal agencies one day to fix it, as shown in the NVD entry for CVE-2025-5777.
What to do now
- List every internet-facing device you rely on, including VPN, remote desktop gateways and firewalls, and confirm each one gets updates.
- Patch edge devices within days of an emergency fix. After patching, end active sessions and rotate credentials, since stolen session tokens can keep working.
- Use phishing-resistant multi-factor authentication for remote access and admin accounts.
- Give every account a unique password stored in a business password manager.
Our patch management and password management services cover the first steps on this list.