What Is the Comcast Data Breach Lawsuit?
The Comcast data breach lawsuit is a consolidated federal class action over an October 2023 cyberattack on Comcast's Xfinity systems, captioned Hasson v. Comcast Cable Communications LLC, Master Docket No. 2:23-cv-05039-JMY.
The case is pending in the U.S. District Court for the Eastern District of Pennsylvania before Judge John Milton Younge. Plaintiffs sued Comcast Cable Communications, LLC and Comcast Corporation on behalf of customers who were notified of the breach.
The Comcast data breach lawsuit is a class action, not a multidistrict litigation. A court-approved class settlement has since resolved the claims against the Comcast defendants.
“Before the Panel is a motion filed by Plaintiff Kenneth Hasson, seeking centralization of the actions on the attached schedule, pursuant to 28 U.S.C. § 1407, in the United States District Court for the Eastern District of Pennsylvania for coordinated or consolidated pretrial proceedings. On March 12, 2024, plaintiff in the sole remaining Southern District of Florida action (Brown, C.A. No. 23-62392) stipulated to the dismissal of his action and all claims therein without prejudice, thus depriving this litigation of its multidistrict character.”
Source: Source: U.S. Judicial Panel on Multidistrict Litigation, In re: Comcast (NetScaler CVE-4966) Customer Data Security Breach Litigation, MDL No. 3099, Order Deeming Motion Moot and Vacating the March 28, 2024, Hearing Session Order, Document 84 (March 14, 2024)
Why Are People Filing Comcast Data Breach Lawsuits?
People filed Comcast data breach lawsuits because plaintiffs allege Comcast failed to secure customer data before attackers reached its internal systems between October 16 and October 19, 2023.
Comcast's own breach notice says Citrix announced a vulnerability in a product Comcast used on October 10, 2023. Citrix released a patch at that time. Comcast says it patched promptly, but states that unauthorized access occurred before mitigation.
Comcast determined on November 16, 2023 that information was likely acquired. Its notice lists usernames and hashed passwords for affected accounts. For some customers, it also lists names, contact information, dates of birth, the last four digits of Social Security numbers, and secret question answers.
The settlement papers list the disputed claims as inadequate data security, unjust enrichment, violations of the federal Cable Act and state consumer laws, and improper notice. Reports on the complaints also describe negligence and breach of implied contract claims.
What Injuries Are Included in the Comcast Data Breach Lawsuit?
The injuries included in the Comcast data breach lawsuit are financial and privacy harms, not physical injuries. The complaints group them into the four categories below. Comcast denies that it caused any of these harms or violated any law.
Identity Theft and Fraud Risk
Identity theft is the unauthorized use of another person's identifying information, such as a Social Security number or date of birth, to open accounts or obtain benefits.
Plaintiffs allege the exposed names, dates of birth, and partial Social Security numbers raised class members' risk of identity theft and fraud. The settlement responds with identity protection and restoration services for class members and reimbursement of documented losses.
Account Takeover and Credential Exposure
Account takeover occurs when someone gains control of an online account by using stolen credentials, such as a username and password.
Plaintiffs allege the exposed usernames and hashed passwords could help attackers reach Xfinity accounts and other accounts that reuse the same password. A hashed password is a scrambled version of a password that is harder, though not impossible, to reverse. Comcast says it asked customers to reset passwords and recommended multi-factor authentication.
Lost Time and Out-of-Pocket Costs
Lost time and out-of-pocket losses are the hours and expenses a person spends responding to a data breach, such as monitoring accounts or replacing cards.
Plaintiffs allege class members spent time and money dealing with the breach's aftermath. The settlement recognizes this harm through documented-loss claims, whose amounts appear in the settlement payout section below.
Delayed Breach Notification
Many states require companies to notify affected people about a data breach within a set period. A late or incomplete notice can itself be alleged as a legal violation.
The complaints allege Comcast failed to notify affected customers properly. Comcast's own notice dates show the intrusion ended October 19, 2023, and customer notices followed on or around December 18, 2023. Comcast disputes that its notice was improper.
Who Qualifies for the Comcast Data Breach Lawsuit?
You may qualify if:
- You reside in the United States or its territories
- Comcast sent you individual notice of the October 2023 data breach, which Comcast publicly disclosed in December 2023
You may not qualify if:
- You were not sent an individual breach notice, because settlement class membership is defined by who received notice
- You validly and timely excluded yourself (opted out) from the settlement class by the opt-out deadline
The claims deadline of September 14, 2026 has already passed. This eligibility summary describes the settlement class definition for reference. Only the settlement administrator's records can confirm whether a specific person was a class member or filed a timely claim.
What Is the Current Status of the Comcast Data Breach Lawsuit?
The current status of the Comcast data breach lawsuit is settled, with final approval granted and the claims window closed. Payments wait on the settlement's Effective Date.
Hasson v. Comcast Cable Communications LLC, No. 2:23-cv-05039-JMY
Kenneth Hasson filed the first complaint in the Eastern District of Pennsylvania on December 19, 2023. Judge John Milton Younge presides over the master docket. The Judicial Panel on Multidistrict Litigation listed ten related actions, nine in Pennsylvania and one in Florida, but deemed the centralization motion moot on March 14, 2024.
Judge Younge granted preliminary approval on January 16, 2026, and entered final approval on August 20, 2026. Coverage of his order says he called the case complex, citing the first application of the federal Cable Communications Policy Act to a cable company data breach.
Earlier notices and some coverage listed an August 14 claims deadline, a June 1 opt-out date, and a July 7 final hearing. The schedule that governed was July 1 for opt-outs and objections, August 5 for the hearing, and September 14, 2026 for claims.
| Proceeding Type | Federal class action under a consolidated master docket (not an MDL) |
| Court | U.S. District Court for the Eastern District of Pennsylvania |
| Judge | John Milton Younge |
| Complaint Filed | December 19, 2023 (Hasson) |
| Defendants | Comcast Cable Communications, LLC and Comcast Corporation (settling defendants) |
| Settlement Fund | $117.5 million |
| Settlement Administrator | Kroll Settlement Administration LLC |
| Settlement Status | Final approval entered August 20, 2026; claims deadline passed September 14, 2026 |
What Is the Comcast Data Breach Lawsuit Settlement Payout Date?
The Comcast data breach lawsuit settlement payout date has not been announced, because payments wait on the settlement's Effective Date and the administrator's claims review. The latest report this page could verify, dated September 25, 2026, said no payments had been distributed. It also reported no appeal.
The Effective Date generally arrives after the 30-day federal appeal window from the August 20, 2026 judgment closes, or after any appeal is resolved. Settlement Insight projected payments in late 2026 at the earliest, absent an appeal. Only the administrator can confirm timing or amounts for a specific claim.
The settlement fund totals $117.5 million and is reported to be non-reversionary, so unclaimed money does not return to Comcast. The fund pays class benefits, identity protection, administration costs, and court-approved attorneys' fees.
Class members could claim reimbursement of documented out-of-pocket losses and lost time up to $10,000 per person. The alternative was a cash payment estimated at up to $50, adjusted pro rata. Reports describe lost time as $30 per hour for up to five hours.
Every class member was also eligible for three years of Identity Defense and Restoration Services, known as CyEx Financial Shield Complete. Enrollment used an individual code from the notice, and no claim form was required.
Judge Younge approved attorneys' fees of $31.7 million, or 27% of the fund, about $7.4 million below the roughly $39.2 million requested. Reports say the reduction stays in the fund for class members.
Comcast Data Breach Lawsuit Updates and Case Status
Here is the current status of the Comcast Data Breach lawsuit, updated with new filings, rulings, and case-count reports as they're confirmed. The Comcast data breach settlement settled as of October 2026; the terms and timing are covered in the entries below. See the full timeline below for every confirmed development since the litigation began.
Comcast Data Breach Lawsuit Timeline of Events
Claims Deadline Passes in the Comcast Data Breach Settlement
The deadline for class members to file a claim in the Hasson v. Comcast Cable Communications LLC data breach settlement passed at 11:59 p.m. Eastern on September 14, 2026. New claims against the $117.5 million fund are now closed.
Court Grants Final Approval and Awards $31.7 Million in Fees
Judge John Milton Younge of the Eastern District of Pennsylvania granted final approval to the $117.5 million Comcast data breach class settlement on August 20, 2026. He approved attorneys' fees of $31.7 million, about 27% of the fund.
Final Approval Hearing Held
The Eastern District of Pennsylvania held the final approval hearing for the Hasson v. Comcast data breach settlement on August 5, 2026. Earlier notices had listed July 7 as the hearing date.
Opt-Out and Objection Deadline
Settlement class members in the Comcast data breach case had until July 1, 2026 to opt out or object. That date came from the amended notice schedule.
Preliminary Approval of the $117.5 Million Settlement
Judge John Milton Younge granted preliminary approval to Comcast's $117.5 million data breach class settlement on January 16, 2026. The settlement class covers about 31.7 million people who received individual notice of the breach.
JPML Deems the Centralization Motion Moot
The Judicial Panel on Multidistrict Litigation deemed Kenneth Hasson's motion to centralize the Comcast data breach suits, MDL No. 3099, moot on March 14, 2024. The Panel vacated its March 28, 2024 hearing session as to the matter.
Last Florida Case Dismissed
On March 12, 2024, the plaintiff in Brown v. Comcast Cable Communications LLC, No. 23-62392, stipulated to dismiss his Southern District of Florida action without prejudice. Every remaining Comcast data breach suit on the Panel's schedule sat in the Eastern District of Pennsylvania.
JPML Schedules a Hearing on Centralization
The Judicial Panel on Multidistrict Litigation filed a Hearing Session Order on February 16, 2024, listing the Comcast data breach centralization motion, MDL No. 3099, for its March 28, 2024 hearing session.
Class Action Reported Against Comcast and Citrix
Law360 reported on January 2, 2024 that Comcast Xfinity customers had brought a class action against Comcast and its software provider Citrix. The suit alleges the companies failed to protect customer information or warn of vulnerabilities.
First Complaint Filed in Hasson v. Comcast
Kenneth Hasson filed the first Comcast data breach class action complaint in the Eastern District of Pennsylvania on December 19, 2023. Prescott v. Comcast Corporation, No. 2:23-cv-05040, was filed the same day.
Comcast Begins Notifying Customers of the Breach
Comcast sent breach notices on or around December 18, 2023. The notices told Xfinity customers their personal information may have been compromised in the October 2023 intrusion.
Comcast Identifies the Exposed Data Types
Comcast concluded on December 6, 2023 that the exposed information included usernames and hashed passwords. For some customers it also included names, contact information, dates of birth, last four Social Security digits, or secret question answers.
Comcast Determines Information Was Likely Acquired
Comcast determined on November 16, 2023 that information was likely acquired in the October intrusion into its internal systems. The company had already notified federal law enforcement and opened an investigation.
Unauthorized Access to Comcast Systems Begins
Between October 16 and October 19, 2023, an unauthorized party accessed some of Comcast's internal systems. The access exploited the Citrix vulnerability known as Citrix Bleed, before Comcast completed mitigation.
Citrix Announces the Vulnerability and Releases a Patch
On October 10, 2023, Citrix announced a vulnerability in a product used by Comcast and released a patch. Citrix issued additional mitigation guidance on October 23, 2023, according to Comcast's breach notice.
How to File a Comcast Data Breach Lawsuit
Filing a Comcast Data Breach lawsuit typically follows the 6 steps below.
- Confirm you received a breach notice: Class membership depends on Comcast having sent you individual notice of the October 2023 breach, by email or postcard.
- Check your claim status with the administrator: Kroll Settlement Administration LLC runs the official settlement website, comcastbreachsettlement.com, and a phone line at (833) 319-2401.
- Activate your identity protection code: Class members could pre-enroll in the included identity protection service using the individual code printed in their notice, even without filing a claim.
- Preserve records of any breach-related losses: Receipts, account statements, and notes on time spent can help document losses if a question arises about a claim already filed.
- Use only the official settlement website: Scam sites imitate settlement portals, so confirm the web address printed on your notice before entering personal details.
- Consult an attorney about independent claims: People who validly opted out kept the right to sue Comcast independently, and only a qualified attorney can assess that option.
Comcast Data Breach Lawsuit is no longer accepting new claims. The court granted final approval on August 20, 2026, and the September 14, 2026 claims deadline has passed, so no new claims can be submitted in this settlement.
What Did Comcast Allegedly Know Before the Data Breach?
Plaintiffs allege Comcast's security measures and patching were inadequate to protect the customer information stored on its systems, and that the company later notified customers improperly. Comcast denies those allegations and says it patched and mitigated promptly.
Legal commentary on the case describes delayed patching after the Citrix announcement as a central plaintiff theory. The court record this page could verify does not resolve that question, because the case settled without a merits ruling.
| Party | Role | Position |
|---|---|---|
| Comcast Cable Communications, LLC and Comcast Corporation | Settling defendants; operators of the Xfinity systems accessed in October 2023 | Deny all material allegations and agreed to resolve the class claims by settlement |
| Citrix Systems, Inc. and Cloud Software Group, Inc. | Software vendor behind the vulnerable product; Citrix Systems is a named defendant in Carey v. Citrix Systems, Inc. et al., No. 2:24-cv-01050 | The settlement agreement releases claims against the Comcast entities; this page could not verify the vendors' final status from the court record |
Coverage of Judge Younge's approval order describes a novel question. The question asks whether a security vendor owes a duty to end users with no direct relationship to it.
How Does the Comcast Data Breach Lawsuit Compare to Related Cases?
Comcast has faced other legal matters tied to customer data. Each item below is legally distinct from the Hasson class action described on this page.
| Matter | What It Involves | Relationship to This Case |
|---|---|---|
| FCC settlement over the FBCS vendor breach | A $1.5 million settlement announced in November 2025. It resolved an FCC investigation into a 2024 breach at Financial Business and Consumer Solutions, a former Comcast debt collector, affecting about 237,000 customers | Separate incident, regulator, and proceeding from the October 2023 Citrix Bleed breach |
| Possible individual suits by opt-outs | Claims that people who validly excluded themselves from the class could bring on their own | Legally independent of the class settlement, and those individuals gave up settlement benefits by opting out |
Frequently Asked Questions
What is the Comcast data breach lawsuit about?
The Comcast data breach lawsuit is a federal class action alleging Comcast failed to protect customer information during an October 2023 cyberattack on its Xfinity systems. The breach exposed usernames and hashed passwords, plus other personal details for some customers.
Is the Comcast data breach lawsuit a class action or an MDL?
The Comcast data breach lawsuit is a class action, not a multidistrict litigation. Hasson v. Comcast Cable Communications LLC proceeds under Master Docket No. 2:23-cv-05039-JMY in the Eastern District of Pennsylvania, and the JPML deemed the centralization motion moot in March 2024.
Did Comcast settle the data breach lawsuit?
Yes, Comcast settled the data breach lawsuit for $117.5 million, and the court granted final approval on August 20, 2026. Comcast denies wrongdoing in the settlement papers.
Can I still file a claim in the Comcast data breach settlement?
No, the claims deadline for the Comcast data breach settlement passed on September 14, 2026, so new claims cannot be filed. The settlement administrator can answer questions about claims already submitted.
When will Comcast data breach settlement payments be sent?
Comcast data breach settlement payments have no announced date and wait on the settlement's Effective Date and the administrator's claims review. Timing depends on whether any appeal delays the Effective Date.
Is the Comcast data breach lawsuit the same as the FCC vendor breach settlement?
No, the Comcast data breach lawsuit is not the same as the FCC vendor breach settlement. The class action concerns the October 2023 Citrix Bleed breach, while the FCC matter concerned a 2024 breach at a former debt collection vendor.
Was Citrix a defendant in the Comcast data breach lawsuit?
Citrix Systems was named as a defendant in at least one related suit, Carey v. Citrix Systems, Inc. et al., listed on the JPML's schedule. The settlement agreement releases claims against Comcast Cable Communications, LLC and Comcast Corporation, and this page could not verify the vendors' final status.