Federal Judge Approves $117.5 Million Comcast Data Breach Settlement: How to Claim Up to $10,000

A federal judge has officially approved a landmark $117.5 million class action settlement with Comcast Cable Communications following a massive security breach that exposed sensitive personal data for roughly 31.7 million customers.

The lawsuit stems from a late 2023 cybersecurity incident where hackers exploited a widely publicized software flaw to bypass security controls and access personal customer files. Under the terms of the court-approved agreement, affected current and former Xfinity customers can claim up to $10,000 in cash reimbursement for documented out-of-pocket expenses or receive a flat $50 cash payment, alongside free credit monitoring services. To receive financial compensation, eligible class members must submit an official claim form before the extended deadline of September 14, 2026.

At ClassActionU.org, our mission is to empower everyday people and ensure corporate giants are held accountable when digital security failures expose private information. Below is a detailed breakdown of the lawsuit, who qualifies for cash payouts, and how you can assert your rights before time runs out.

What Caused the Historic Comcast Data Breach?

The class action lawsuit arose from a cyberattack that took place between October 16 and October 19, 2023. Cybercriminals exploited a critical software vulnerability known as “Citrix Bleed” within the Citrix NetScaler appliances that Comcast used to manage remote access for its employees and external contractors.

Despite software security patches being made available by Citrix to fix the flaw, plaintiffs alleged that Comcast failed to install the updates in a timely manner. Comcast did not discover the intrusion until October 25, 2023, during a routine cybersecurity check, and waited until December 18, 2023—roughly two months after the initial break-in—to send formal breach notifications to affected subscribers.

The lawsuit charged both Comcast and Citrix with failing to implement adequate data security safeguards, exposing millions of consumers to immediate identity theft, financial fraud, and ongoing privacy risks. Both Comcast and software developer Citrix denied all allegations of wrongdoing, but Comcast agreed to fully finance the $117.5 million settlement fund to resolve all claims.

What Sensitive Personal Information Was Exposed?

The scale of the breach makes it one of the largest telecommunications data exposures in history. According to court filings, unauthorized third parties accessed sensitive customer records containing:

• Full legal names and contact information

• Dates of birth and account log-in credentials (usernames and passwords)

• Secret security questions and answers

• Partial Social Security numbers (last four digits)

• Full Social Security numbers and driver’s license numbers for select individuals

When sensitive records like Social Security numbers and account credentials fall into the hands of cybercriminals, consumers face long-term risks of unauthorized credit applications, account takeovers, and targeted fraud scams.

Unpacking the Legal Principles and Cable Act Claims

The litigation stands out as one of the most legally complex data privacy cases to date. Presiding Judge John Younge of the U.S. District Court for the Eastern District of Pennsylvania highlighted that the case involved unique legal hurdles and complex technical evidence.

Plaintiffs asserted 23 separate causes of action, including state privacy claims and a novel claim under the federal Cable Communications Policy Act. Legal analysts noted this was the first time the federal Cable Act was invoked against a cable operator for a cybersecurity breach, raising unparsed legal questions regarding whether customer account details meet the statutory definition of personally identifiable information.

Additionally, the lawsuit tested whether third-party cybersecurity vendors like Citrix owe a legal duty of care to everyday consumers who never interacted directly with their software. By securing a $117.5 million resolution through five separate mediation sessions, class action attorneys established a major precedent for holding both service providers and their third-party software vendors accountable for digital safety.

Who Is Eligible to Receive Settlement Compensation?

You may be eligible to submit a claim and receive cash compensation if you meet the following court criteria:

• You are a living individual residing in the United States or its territories;

• You used Comcast/Xfinity services during or prior to the October 2023 data breach; and

• You were sent a formal written notice of the data breach from Comcast on or around December 18, 2023, informing you that your personal information was compromised.

If you received an official notice via mail or email containing a unique Settlement Member ID, you are an eligible class member.

Cash Payout Options and Settlement Benefits

The $117.5 million settlement provides several flexible compensation pathways for affected customers:

• Documented Financial Losses (Up to $10,000): Class members who suffered documented out-of-pocket financial losses, fraudulent charges, or lost time addressing identity theft tied to the breach can claim reimbursement up to $10,000 per person.

• Alternative Cash Payout ($50 Flat Payment): As an alternative to providing itemized receipts, eligible class members can select a flat cash payment estimated at $50.

• Free Credit Monitoring Services: All settlement class members—regardless of whether they file a cash claim—are eligible to enroll in complimentary credit and identity defense monitoring services.

Critical Deadlines and How to Submit Your Claim

To receive financial compensation, you must complete and submit an official claim form before the final cutoff date. The court-ordered schedule is outlined below:

Follow these simple steps to complete your submission:

1. Submit Online: Go to the official, court-approved settlement portal at comcastbreachsettlement.com and enter your unique Settlement Member ID to complete the online form.

2. Submit by Mail: Download a paper claim form from the official website, fill out the required sections, attach any receipts for out-of-pocket financial losses (if claiming itemized damages), and postmark it no later than September 14, 2026.