Comcast Settles Xfinity Data Breach Lawsuit for $117.5 Million
Millions of customers can now file claims following a 2023 cyberattack that exposed personal data.
Comcast has agreed to a $117.5 million settlement to resolve a class-action lawsuit stemming from a massive data breach. The agreement addresses the exposure of personal information belonging to approximately 36 million Xfinity customers.
The settlement resolves the legal case Hasson v. Comcast Cable Communications, LLC (Case No. 2:23-cv-05039-JMY), filed in the Eastern District of Pennsylvania. The litigation followed a third-party cyberattack that occurred between October 16 and October 19, 2023, during which unauthorized actors gained access to customer data. While Comcast has denied any wrongdoing, the company agreed to the financial payout to end the litigation. Eligible U.S. residents who received a breach notice in late 2023 have until September 14, 2026, to file claims for cash payments and identity protection services.
The Third-Party Vulnerability
This incident underscores a growing trend in the telecommunications sector where security failures at third-party vendors create critical vulnerabilities for primary service providers. In this instance, the breach did not occur through a direct failure of Comcast's internal systems, but rather through an external partner. Despite the origin of the attack, the scale of the exposure—affecting tens of millions of users—triggered the extensive legal action and the subsequent multimillion-dollar fund.
Industry Implications
This settlement is one of the larger data breach resolutions on record, signaling an increase in the financial liability for telecom giants. As these companies aggregate vast amounts of consumer data, the cost of failure—even when the breach occurs via a third party—is rising. The case sets a precedent for how courts value the exposure of personal information and the necessity for companies to provide tangible recovery mechanisms, such as identity monitoring and out-of-pocket loss reimbursement, for affected users.
What to Watch
Attention now shifts to the claims process and the total number of participants, which will determine the final distribution of the $117.5 million fund. While the settlement provides a path for recovery, the long-term impact on Comcast's third-party risk management protocols remains to be seen. Users should monitor their official breach notices to confirm eligibility before the September 2026 deadline.