A federal court approved the $117.5 million Hasson v. Comcast settlement on Aug. 20, 2026. It resolves claims over the October 2023 Xfinity breach. Eligible customers could seek up to $10,000 for documented losses or take a flat payment of about $50.
Hasson v. Comcast is the class-action case over unauthorized access to Xfinity customer systems. Xfinity is Comcast's residential internet, TV, and phone brand. The class covers U.S. customers who received breach notices.
Official resources:
- Explore the official data from Databreaches — Use this primary source to review the underlying data.
- Read the original research from Insurancejournal — Use this page to review the original research.
Table of Contents
- Who was included in the class?
- What customer data was exposed?
- What could customers claim?
- How did customers file, and what happens after the deadline?
Who was included in the class?
The class covers about 31.6 million U.S. persons sent individual breach notices on or around Dec. 18, 2023. The notice stated personal information may have been compromised.
The underlying incident was larger than the class. Attackers used the CitrixBleed flaw, tracked as CVE-2023-4966, to enter Xfinity systems Oct. 16-19, 2023. They extracted records tied to about 35.8 million customer accounts.
What customer data was exposed?
Exposed data included usernames and hashed passwords for affected accounts. Hashing scrambles a password, but exposed credentials still raise takeover risk when passwords are reused.
For some customers, more records were involved. Those included names, contact information, birthdates, last four digits of Social Security numbers, and security questions with answers.
What could customers claim?
Insurance Journal reported the cash options in its account of the final approval. ConsumerAffairs described the added protection in its summary of settlement benefits.
The services included credit and dark-web monitoring plus identity-theft protection. The documented-loss route required receipts or other proof. The flat payment traded a larger possible award for a simpler claim.
- Up to $10,000 for documented out-of-pocket losses and lost time tied to the breach
- An alternative flat cash payment of about $50 without documentation
- Three years of identity-defense and restoration services
How did customers file, and what happens after the deadline?
The official claim form set the filing cutoff at 11:59 p.m. ET Sept. 14, 2026, according to the settlement claim instructions. Online claims went through comcastbreachsettlement.com. Mailed claims needed a postmark by that date.
They went to Hasson v. Comcast c/o Kroll, P.O. Box 5324, New York, NY 10150-5324. Missing the deadline forfeits payment and preserves the release of Comcast and Citrix from class claims. Comcast denies wrongdoing and funded the full common fund.
You Might Also Like
- Lemonade Insurance Data Breach: When Can You Activate Settlement Credit Monitoring?
- Does the On Q Financial Data Breach Settlement Include More Credit Monitoring?
- M&S Data Breach: What Masked Card Details Mean for Customers