The October 2023 Xfinity data breach affected 35,879,455 people, according to a Maine Attorney General filing. Xfinity said usernames and hashed passwords were involved; for some customers, additional personal details were also affected. The claims deadline for the court-approved settlement was September 14, 2026, and has passed.
What happened in the Xfinity data breach?
Xfinity said unauthorized access to some internal systems occurred from October 16 through October 19, 2023, and that its investigation concluded the incident resulted from a Citrix vulnerability. The company said the information was likely acquired on November 16, 2023, and that it concluded on December 6 that customer data was involved. These are Xfinity’s statements about its investigation.
The Maine Attorney General’s breach filing lists 35,879,455 people affected, including 50,782 Maine residents. The filing’s search result does not display its year. The precise reported total is the basis for describing the incident as affecting about 36 million people.
Incident timeline
- October 10, 2023: Xfinity’s notice says Citrix announced a vulnerability and released a patch.
- October 16–19, 2023: Xfinity says unauthorized access to some internal systems occurred.
- November 16, 2023: Xfinity says it determined information was likely acquired.
- December 6, 2023: Xfinity says it concluded customer information was involved. The Maine filing lists this as the discovery date.
- December 18, 2023: The Maine filing lists this as the consumer-notification date.
What information was exposed?
Xfinity’s December 6 notice said the affected information included usernames and hashed passwords. A hashed password is not the same as a plain-text password, but it is still sensitive account data. Xfinity did not say that every affected customer had all the additional data below exposed.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute#1 Best Overall
For some customers, the notice said the information also included one or more of the following:
- Names and contact information
- The last four digits of Social Security numbers
- Dates of birth
- Secret questions and answers
Xfinity said its analysis was continuing and that additional customer notices could follow. The reported total of people affected does not mean every person’s Social Security digits, date of birth, or other additional information was involved.
Did the breach affect your Xfinity account?
Xfinity’s notice describes password-reset prompts and customer notifications, but the reviewed official information does not establish a public account checker that can confirm an individual’s status. Check your Xfinity account directly and review communications received from the company; do not treat a message from an unknown sender as proof that your account was affected.
What should Xfinity customers do?
Secure your Xfinity sign-in
- Use the password-reset prompt within your Xfinity account if prompted. Choose a unique password that you do not use on another service.
- Enable two-factor or multifactor authentication where available. Xfinity strongly encouraged customers to do this.
- If you reused your Xfinity password elsewhere, change it on those accounts too, starting with email and financial accounts.
Xfinity says it will not contact customers by phone, email, or text to ask them to update passwords. Treat direct messages requesting a password update as potentially fraudulent; go to your account through a route you already trust instead of following the message’s link.
Review financial and credit records
- Check financial statements for transactions you do not recognize.
- Review your credit reports for unfamiliar accounts or activity.
- Consider a security freeze or fraud alert if you are concerned about misuse of your information.
Xfinity’s notice says a security freeze is free and must be placed separately with each major credit bureau. A freeze can make it harder for creditors to access your credit file, but it may delay applications for credit, housing, employment, or other services. A fraud alert is another option described in the notice.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happened with the Xfinity breach settlement?
The court-authorized Hasson v. Comcast settlement website reports that the court approved the settlement on August 20, 2026. It lists a $117.5 million settlement fund and a claims deadline of September 14, 2026. That deadline has passed, so the website should not be read as offering an open claims period. Use the official settlement site for any updates about the case or settlement administration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
