After that date, the right to compensation vanishes.
In the autumn of 2023, a known software vulnerability became the door through which hackers entered Comcast's systems and quietly gathered the personal details of 36 million people — names, passwords, partial Social Security numbers, the quiet architecture of identity. What followed was a two-month silence, then lawsuits, and ultimately a $117.5 million settlement that now sits waiting to be claimed. The settlement is a rare moment where institutional accountability translates into tangible relief, but only for those who know the door is open and walk through it before August 14, 2026.
- Hackers exploited a known Citrix vulnerability over four days in October 2023, stealing data comprehensive enough to enable years of identity fraud for 36 million customers.
- Comcast waited nearly two months to notify affected users, a delay that drew federal lawsuits and ultimately forced one of the largest data breach settlements in the company's history.
- The $117.5 million settlement offers real money — up to $10,000 for documented losses, $150 for time spent resolving issues, or roughly $50 with no paperwork required — but none of it flows automatically.
- A court approval hearing is set for July 7, 2026, with the claims deadline following on August 14 — after which all rights to compensation are permanently forfeited.
- Every eligible claimant automatically receives three years of identity protection including dark web monitoring and up to $1 million in theft insurance, but the cash requires deliberate action at ComcastBreachSettlement.com.
Over four days in October 2023, cybercriminals exploited a vulnerability in Citrix software to extract personal data from roughly 36 million Xfinity accounts — full names, passwords, birth dates, security questions, and the last four digits of Social Security numbers. Comcast discovered the intrusion on October 25 but waited until December 18 to tell customers. That silence became the foundation of a federal class action lawsuit in Pennsylvania, accusing the company of inadequate security and slow disclosure.
Comcast neither admitted wrongdoing nor mounted a vigorous defense. Instead, it agreed to a $117.5 million settlement — one of the largest of its kind in the company's history — to resolve the claims. The agreement now offers three compensation paths: up to $10,000 for documented losses such as fraudulent charges or credit monitoring costs; up to $150 for time spent resolving breach-related problems, calculated at $30 per hour with a written explanation; or an alternative payment of roughly $50 requiring no documentation, though the final amount may vary based on total claims filed.
To participate, eligible customers — those who received Comcast's official breach notification in December 2023 — must file at ComcastBreachSettlement.com before August 14, 2026. The court must first approve the settlement at a July 7, 2026 hearing before any funds are distributed. Those who wish to pursue independent legal action must request exclusion by June 1, 2026. Missing either deadline closes the door permanently.
All eligible claimants automatically receive three years of identity protection through CyEx Financial Shield Complete, covering credit monitoring, dark web surveillance, real-time alerts, and up to $1 million in identity theft insurance. The protection requires no action. The money does — and for communities that historically engage less with class action processes, awareness of these deadlines may be the deciding factor between recovering losses and carrying them alone.
In October 2023, hackers slipped through a crack in Comcast's defenses and walked away with the personal details of roughly 36 million Xfinity customers. The breach happened over four days—October 16 through 19—when cybercriminals exploited a known vulnerability in Citrix software called "Citrix Bleed." The company discovered the intrusion on October 25, but didn't notify customers until December 18. That two-month silence drew lawsuits.
What the hackers took was comprehensive enough to fuel years of trouble: full names, passwords, birth dates, security questions, and the last four digits of Social Security numbers. For anyone who has lived through identity theft, this is the starter kit for financial ruin. The breach landed in federal court in Pennsylvania, where a class action lawsuit accused Comcast of failing to maintain adequate security and dragging its feet on disclosure. The company neither admitted wrongdoing nor fought hard—it simply agreed to pay $117.5 million to make the problem go away, one of the largest data breach settlements in recent company history.
Now comes the part that matters most: the money is real, but only if you claim it. Eligible customers—those who received Comcast's official breach notification in December 2023—have until August 14, 2026, to file. After that date, the right to compensation vanishes. The settlement offers three paths. You can claim up to $10,000 for documented losses: fraudulent charges, credit monitoring fees, identity theft insurance premiums, anything you can prove the breach cost you. If you don't have receipts but spent time untangling the mess, you can claim up to $150 for that labor, calculated at $30 per hour for up to five hours, provided you write an explanation. For those who want compensation without paperwork, there's an alternative payment of roughly $50, though that amount may shift depending on how many claims come in and what's left after legal fees.
To claim, you need to visit ComcastBreachSettlement.com and find your Class Member ID using the email notification you received or by looking up your Xfinity account details. The process is free. Payments arrive by bank transfer, Venmo, or check in the mail. But here's the catch: the money doesn't flow automatically. The court must approve the settlement first—that hearing is scheduled for July 7, 2026—and funds only go to people whose claims are actually accepted.
Every eligible claimant also receives three years of identity protection through CyEx Financial Shield Complete, which includes credit monitoring, dark web surveillance, real-time alerts, and up to $1 million in identity theft insurance, plus monthly credit score tracking. That protection is automatic; the cash requires action.
The calendar is unforgiving. If you want to opt out of the settlement and sue Comcast separately, you must request exclusion by June 1, 2026. If you want to claim money, you must file by August 14, 2026. Miss either deadline and the door closes permanently. For communities that historically participate less in class action settlements—including Spanish-speaking households—the difference between knowing about these dates and not knowing could mean the difference between recovering losses and absorbing them alone.
Citas Notables
The company discovered the intrusion on October 25, but didn't notify customers until December 18.— Settlement timeline
La Conversación del Hearth Otra perspectiva de la historia
Why did it take Comcast two months to tell people their data was stolen?
The company discovered the breach on October 25 but didn't notify customers until December 18. The lawsuits that followed suggest the delay itself became part of the injury—people had no chance to protect themselves during those eight weeks.
What exactly did the hackers get?
Names, passwords, birth dates, security questions, and the last four digits of Social Security numbers. That combination is dangerous because it gives someone most of what they need to impersonate you financially or open accounts in your name.
So how much money are we talking about here?
The settlement is $117.5 million total. But the actual payout depends on what you claim. You can get up to $10,000 if you have receipts for losses, $150 if you document your time fixing things, or about $50 if you just want something without proof.
And if I don't claim anything by August?
The right to compensation disappears. Permanently. The court has to approve the deal first in July, but the filing deadline is August 14, 2026. After that, you have no claim.
Does everyone get something automatically?
No. The identity protection—three years of monitoring and insurance—is automatic for eligible people. But the cash only goes to those who actually file a claim and get it approved. You have to do the work.
Why would Comcast agree to this if they didn't admit they did anything wrong?
They didn't admit fault, but they also didn't want to fight. A $117.5 million settlement was cheaper and faster than years of litigation. They also agreed to improve their security practices going forward.