November 6, 2026
Updated: November 11, 2026
The court approved the $117.5 million deal in August 2026 and claims closed September 14. Here is who qualifies, what it pays, what is still unknown and what to do next.
Mohammed Khalil
The Comcast data breach settlement is a $117.5 million class action deal for people who were individually notified of the October 2023 Xfinity breach. A federal judge approved it on August 20, 2026, and the deadline to file a claim passed on September 14, 2026. When we checked on November 7, 2026, the official settlement website had not posted a payment date. If you filed, your main job now is to keep your contact details current. If you did not, you can still protect your accounts. This is general information, not legal advice.
| Question | Answer as of November 7, 2026 |
|---|---|
| Case | Hasson v. Comcast Cable Communications, LLC, No. 2:23-cv-05039-JMY, Eastern District of Pennsylvania |
| Settlement fund | $117,500,000 |
| Who is covered | People in the US and its territories who were sent individual notice of the October 2023 breach |
| Court approval | Granted; order dated August 19 and filed August 20, 2026 |
| Claim deadline | September 14, 2026 (closed) |
| Opt-out and objection deadline | July 1, 2026 (closed) |
| Cash options | Up to $10,000 for documented losses and lost time, or an estimated $50 |
| Other benefit | At least three years of identity monitoring and restoration services |
| Payment date | Not posted |
| Administrator | Kroll Settlement Administration |
The official settlement website and the court's final approval order are the two records to trust. DeepStrike has no connection to the case, Comcast or the administrator.
Two things confuse readers. Many older articles list an August 14 claim deadline and a July 7 hearing. Those dates come from the court's January 2026 order and were later moved. Also, parts of the official site still say "proposed settlement" and describe the hearing as upcoming, even though its banner and documents page show that the court has approved the deal.
The claim window closed on September 14, 2026, for both online forms and mailed forms postmarked by that date. There is no general right to file now.
There is one narrow exception, and it should not be relied on. Paragraph 16 of the January 2026 order says class counsel has discretion, but no obligation, to accept late claims if processing them will not materially delay payments to others. If you have a specific reason you missed the deadline, you can ask the administrator at (833) 319-2401, the number on the court-authorized site. Do not pay anyone who promises to get a late claim accepted.
Missing the deadline does not cost you everything. The same order says every class member can use the restoration services for as long as they run, even without enrolling or filing. The settlement FAQ also says class members can enroll in the identity services without a claim form. After the settlement becomes final, the administrator or the provider, CyEx, is due to email enrollment instructions.
On October 10, 2023, Citrix announced a flaw in its NetScaler ADC and Gateway products and released a patch. The flaw, CVE-2023-4966, became known as Citrix Bleed. According to CISA, it could expose session authentication tokens, which an attacker could use to hijack a logged-in user's session.
Xfinity's customer notice says unauthorized access to some of its internal systems took place between October 16 and October 19, 2023, before mitigation, and that it concluded this resulted from the Citrix vulnerability. It determined on November 16 that information was likely acquired, and on December 6 it concluded which data was involved. Customer notices began on December 18, 2023, and the first lawsuit followed the next day.
What data was involved. Xfinity's notice lists usernames and hashed passwords. For some customers, it also lists names, contact information, the last four digits of Social Security numbers, dates of birth and secret questions and answers. The plaintiffs went further and alleged that full Social Security numbers and driver's license numbers were taken for some class members, as the court's memorandum records.
How many people. You will see two figures. TechCrunch reported in December 2023 that Comcast's filing with Maine's attorney general listed almost 35.8 million affected customers. The court's August 2026 memorandum describes about 31.5 million people in the settlement class. The sources we read do not reconcile the two numbers. Neither one tells you whether you are included. The notice test below does.
Who was at fault. No court has decided that. The plaintiffs alleged that Comcast failed to install the patch in time and that Citrix failed to adequately test and monitor its product. Comcast and Citrix denied wrongdoing, and Xfinity's notice says it promptly patched and mitigated its systems. The case settled, so those questions were not resolved at trial.
You are in the settlement class if you live in the United States or its territories and were sent individual notice of this breach, which Comcast disclosed in December 2023. Being an Xfinity customer is not enough, and you do not have to be a customer today. Settlement notices then went out by email starting April 9, 2026, and by postcard starting April 16, 2026. The court accepted an estimate that direct notice reached 97.69% of the class.
The class excludes Comcast and its officers, directors and employees, the judges on the case and their staff, and anyone who validly opted out. About 745 people had done so by the July 1 deadline. It also excludes certain people who had already brought or released arbitration claims over the breach.
This is not the 2024 FBCS incident. Comcast also notified customers about a separate breach at a former debt-collection vendor, FBCS, which occurred in February 2024. It affected about 270,000 Comcast customers and led to a $1.5 million FCC settlement reported in November 2025, in which Comcast did not admit wrongdoing. That matter is not part of this $117.5 million fund, so a notice about FBCS does not put you in this class.
| Benefit | What it covers | Limit | What was required |
|---|---|---|---|
| Out-of-pocket losses | Unreimbursed fraud or identity theft costs, credit freeze costs and related expenses from October 16, 2023 | $10,000 per person, combined with lost time | Claim form, sworn statement and documents |
| Lost time | Time spent dealing with misuse or taking preventive steps | $30 an hour, up to 5 hours ($150) | Claim form and self-certified explanation |
| Alternative cash payment | No loss needs to be shown | Estimated $50, adjusted pro rata | Claim form |
| Identity services | CyEx Financial Shield Complete, including credit monitoring and $1 million in identity theft insurance | At least three years; retail value stated as $179.40 a year | No claim form; enrollment code from the notice |
People who filed a documented claim receive the greater of their approved amount or the alternative cash payment.
No honest source can give you an exact figure yet. The $50 is an estimate, and the FAQ says valid claims will be adjusted up or down in proportion to the money available.
Here is what the court record shows, using the final order and memorandum. The judge awarded attorneys' fees of $31,725,000, which is 27% of the fund and about $7.44 million less than counsel requested. The memorandum also lists $439,649.44 in litigation expenses and $5,000 service awards for each of 11 class representatives, or $55,000. Up to $7.3 million of notice and administration costs come from the fund, and Comcast pays anything above that separately. Subtracting those items leaves about $78.0 million before the cost of identity services.
That figure is our own arithmetic, not a court number, and three unknowns keep it from becoming a per-person estimate:
The fund is non-reversionary, so unused money cannot go back to Comcast. Under the settlement, it can go to class members, extend the identity services or be used as the court orders.
Payments come after the settlement's Effective Date, and no date had been posted when we checked on November 7, 2026. The settlement agreement sets that date only after the approval order becomes final, meaning the time for appeal has run out or any appeal has been resolved. Claims also have to be processed, and incomplete claims get a 30-day period to be cured.
The judge overruled all objections, including 15 timely ones, but objectors can have appeal rights. We could not confirm from public sources whether an appeal has been filed. Some articles say payments should already have started. We found nothing in the court record or on the official site to support that, so treat any promised date with caution unless the official site confirms it.
Unless you opted out by July 1, 2026, you are still bound by the settlement's release, so you generally cannot bring your own lawsuit over these claims. If you have serious unreimbursed losses and questions about your rights, speak to a lawyer. The identity services described above remain available to you.
These steps come from Xfinity's notice and from federal guidance at IdentityTheft.gov. They are worth taking whether or not you get paid:
Exposed security questions deserve attention too. Xfinity's advice to change reused information applies to any account where you gave the same answer. For context on the wider problem, see our identity theft statistics.
Attention around a large settlement gives scammers a ready-made story, and closed deadlines do not stop them. These rules help:
A real settlement message and a phishing attempt can look alike because attackers copy the format. Our guides to social engineering and spear phishing explain the pressure tactics to watch for.
The court did not decide whether Comcast patched too slowly, and this section does not either. The public record is still useful, because the timing shows how little room defenders had. Citrix released its fix on October 10, 2023, and the access at Xfinity began on October 16. Three lessons apply to any organization running internet-facing appliances, and two more apply to anyone storing customer logins and personal data.
Sector context is in our telecom cybersecurity statistics, and broader trends are in our data breach statistics.
Testing can show whether these controls hold in practice. A network penetration test can check what your internet-facing systems expose, what a valid session could reach internally and whether a fixed issue stays fixed. It does not guarantee that a breach will not happen.
Yes. It is a court-approved class action in the US District Court for the Eastern District of Pennsylvania, and the court authorized the official website. Individual messages may still be fake, so verify anything you receive through the official site.
You are included if you were sent individual notice of the October 2023 breach and did not opt out. If you are not sure, contact the administrator through the official site. A general Xfinity account does not by itself make you a class member.
No. Comcast denies that it engaged in any wrongdoing or violated any law. The court approved the settlement as fair, reasonable and adequate, but it did not rule on who was at fault for the breach.
Citrix Systems and Cloud Software Group were defendants, and the court record describes a global resolution that releases all defendants. The official site says Comcast will pay the $117.5 million into the settlement fund.
Valid claims are adjusted in proportion to the money left after approved deductions. That means the amount depends on the final number and value of claims. The $50 cash figure is an estimate, and the $10,000 figure is a cap rather than a typical payment.
If the Citrix Bleed timeline raises questions about your own environment, start with one recent critical patch. Ask whether active sessions were ended, whether credentials were rotated, whether anyone searched logs from before the fix and whether someone confirmed that the exposure was gone.
DeepStrike's penetration testing services include infrastructure penetration testing, with every assessment conducted manually. To scope a test of your internet-facing systems, contact DeepStrike.
Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.
Stay secure with DeepStrike penetration testing services. Reach out for a quote or customized technical proposal today
Contact Us
