36 Million Xfinity Customers Were Hacked — Here’s How to Claim Your Share of $117.5 Million

When a business informs you months later that a stranger was looking through your personal information, there’s a certain type of annoyance that arises. Tens of millions of Xfinity customers essentially experienced that in late 2023, and Comcast’s sluggish, corporate handling of the fallout made matters worse rather than better.

Hackers took advantage of a known flaw in software developed by cloud computing company Citrix for three days in October 2023, from the 16th to the 19th. They didn’t need to make a big entrance. The door was ajar already. Once inside, they collected contact information, usernames, hashed passwords, partial Social Security numbers, birth dates, and security questions from what the business later verified was a sizable customer base.

Information	Details
Company Name	Comcast Corporation
Headquarters	Philadelphia, Pennsylvania, USA
Service Brand	Xfinity
Breach Dates	October 16–19, 2023
Settlement Amount	$117.5 million
Estimated Eligible Claimants	~30–36 million U.S. customers
Data Compromised	Usernames, hashed passwords, partial Social Security numbers, birth dates, security questions, contact information
Root Cause	Vulnerability in Citrix cloud software used by Comcast
Claims Deadline	August 14, 2025
Opt-Out / Objection Deadline	June 1, 2025
Final Approval Hearing	July 7, 2025 — U.S. District Court, Eastern District of Pennsylvania
Settlement Website	comcastbreachsettlement.com
Compensation Options	Up to $10,000 (documented losses), $30/hour for time spent (up to 5 hrs), or ~$50 flat payment
Additional Benefits	Three years of credit monitoring and identity theft insurance
Comcast’s Position	Denies wrongdoing

It wasn’t until December that Comcast made a statement. The U.S. District Court for the Eastern District of Pennsylvania eventually consolidated 24 distinct class-action lawsuits into a single case, with the two-month lapse serving as a major point of contention.

The outcome is a $117.5 million settlement, which is among the biggest payouts for consumer data breaches in recent memory. As is customary in these agreements, Comcast disputes any misconduct. It’s difficult to read corporate settlements without raising an eyebrow when you see that phrase. The data systems of the company were compromised.

For weeks, customers were kept in the dark. Officially, though, nothing went wrong. It’s a different matter entirely if that framing can withstand scrutiny. For the majority of people, what matters now is whether they are eligible for a payout and how to obtain it.

A customer’s eligibility is based on whether or not Comcast notified them of a breach in December 2023. A Class Member ID, a unique number needed to submit a claim via the settlement website, should have been sent to you if you received that email. You can check your status using your name and the email address, phone number, or physical address linked to your Xfinity account if you deleted the email, forgot about it, or just never received one despite being impacted.

Three different compensation paths are available. The most important one enables clients to claim up to $10,000 if they can prove financial harm, such as fraud, identity theft expenses, credit monitoring fees, and banking charges. For someone who spent months sorting through the fallout from stolen personal information, that is significant money. The second option pays $30 per hour, up to five hours, for time spent addressing issues related to breaches.

The third option, which is by far the most popular choice for the majority of people, is a flat alternative cash payment that is estimated to be around $50, subject to change based on the total number of claims filed. Each flat payment may ultimately be less as more people file.

That final detail has a subtle revealing quality. There are 36 million possible claimants, and the average payout for an individual without supporting documentation is $50. Fifty dollars is not insignificant. However, even though the total settlement sounds enormous from a headline perspective, the scale of corporate data negligence is put into a strange kind of relief with a number so large that it nearly rounds to nothing per person. Whether the majority of qualified clients will even bother to file is still up in the air.

August 14 is the deadline for filing claims. By June 1st, anyone who wishes to completely opt out and file a separate lawsuit against Comcast must do so. Before any payments are made, a federal judge will hold a final fairness hearing on July 7 to decide whether the terms of the settlement are reasonable and sufficient. Nothing is distributed until the judge gives his or her approval, so that hearing is crucial.

Three years of identity protection services, such as credit monitoring and identity theft insurance, are also included in the settlement. That’s a tangible, if small, benefit that goes far beyond a one-time check for individuals who were shaken by the breach or who are still uncertain whether their information has been misused.

It’s important to consider how this breach initially occurred. Comcast’s product was dependent on cloud software from Citrix, which had a known vulnerability. Known, in the sense that it had been recognized by the general public. It had been brought to the attention of industry experts and security researchers. Among the businesses that hadn’t finished patching it in time was Comcast.

By industry standards, thousands of organizations experience patching delays, so this context doesn’t make the company particularly careless. However, it raises an important question that is often obscured by settlement language: at what point does the pattern of delayed responses and known vulnerabilities cease to be an industry norm and begin to be something more intentional?

The Comcast case appears less like a singular incident and more like a well-known chapter in a continuing narrative about how big businesses handle consumer data as it has developed over the past 18 months. Silently, the breach took place. The revelation was made after the fact. The lawsuit was filed quickly. Eventually, a settlement was reached. Tens of millions of people now have a brief window of time to determine whether it is worthwhile for them to file a claim.

The answer is most likely yes for anyone who still has their Class Member ID and received that notification in December 2023. Online filing is practically free. Each option is explained in detail on the settlement website. The majority of the impacted customers will only ever see this as a tangible accountability mechanism, regardless of the ultimate payout.