Comcast has agreed to pay $117.5 million to settle a class-action lawsuit over a 2023 data breach that hit its Xfinity internet, cable and phone customers, and the claims window is still open. Eligible customers can request an estimated $50 with no documentation required, or file for reimbursement of up to $10,000 in documented losses and lost time tied to the breach. The deadline, originally set for mid-August, was pushed back to September 14, giving current and former Xfinity subscribers a second chance to file before the fund closes.
The CitrixBleed breach that triggered the lawsuit
The breach began after attackers exploited a software flaw known as CitrixBleed in a Citrix server Xfinity used, gaining access to its network between October 16 and October 19, 2023, according to the notice of data security incident Comcast sent to affected customers. The exposed information included usernames and hashed passwords, account names, contact details, dates of birth, the last four digits of Social Security numbers, and the secret questions and answers customers had set up for account recovery. Comcast has said it found no evidence the stolen data was posted publicly or used to attack customer accounts directly, but the scale of the intrusion, ultimately covering more than 35 million current and former subscribers, drove multiple class-action suits that were consolidated into the case now known as Hasson v. Comcast Cable Communications LLC. The lawsuits alleged Comcast failed to maintain adequate security safeguards and was slow to notify affected customers once the intrusion was discovered, claims Comcast denies as part of a settlement that resolves the litigation without any finding of fault.
Free retirement updates: Want plain-English help keeping more of your money in retirement? The free Retirement Shield newsletter covers the benefits, deadlines, and money mistakes that cost retirees, a couple times a week. Subscribe free.
How the $50 payment and the $10,000 documented-loss claim differ
Every eligible claimant chooses one path on the claim form, according to the settlement’s FAQ page. The simpler option is an alternative cash payment, estimated at $50, that requires no proof of loss at all; the exact figure could move slightly depending on how many customers select it, since it draws from a shared pool after fees and other payouts are subtracted. Customers who suffered real financial harm tied to the breach — bank or credit-card fraud, costs to freeze and unfreeze credit, replacement identification fees, or comparable identity-theft expenses — can instead file for reimbursement with supporting records such as credit card statements, bank statements, invoices, receipts or police records. A separate lost-time benefit reimburses $30 an hour for up to five hours spent addressing the breach, whether or not a claimant also files for documented losses; the FAQ page notes that out-of-pocket losses and lost time share a combined $10,000 payment cap per claimant.
Who qualifies and how to check a settlement ID
The settlement class covers anyone who was a Comcast Xfinity internet, video or home-phone customer as of October 2023, including people who have since canceled service. Comcast and the claims administrator, Kroll Settlement Administration, mailed or emailed notices containing a unique settlement ID to known class members in December 2023; someone who believes they qualify but never received a notice can still look up eligibility directly on the official settlement site using account information on file. Filing takes only a few minutes online, though claimants choosing the documented-loss track should have receipts or statements ready to upload before starting the form. Anyone eligible can also enroll in the settlement’s identity-defense services even without filing a cash claim.
Why the September 14 date is the real cutoff this time
The claims deadline was originally August 14, then extended once to September 14 after the court approved additional time for notice to reach class members; the opt-out and objection deadline had already passed on July 1, and the court held its scheduled final approval hearing on August 5 at the James A. Byrne U.S. Courthouse in Philadelphia. Claimants who miss the new September 14 date lose access to all three payment options, though the case’s broader legal release still applies to class members whether or not they file, and actual payments are not expected to go out until after final approval is entered and any appeals are resolved. Anyone still deciding how to protect their information can also place a free security freeze at each of the three national credit bureaus under federal law, a separate step the Federal Trade Commission recommends after any breach involving Social Security numbers, and one that does not depend on filing a settlement claim. The settlement administrator’s own site also warns that comcastbreachsettlement.com is the only authorized website for this case, a reminder worth heeding given how often data-breach claim scams mimic real settlement notices to harvest bank details from people trying to file a legitimate claim.
This article was researched and drafted with the assistance of AI and reviewed by The Financial Wire editorial team.
More Financial Reading
- Bank statements: how long to keep them and when to toss them
- Adding someone to your bank account: tax traps and smart moves
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
