Comcast Xfinity Data Breach Settlement: How to Claim
At a glance
- Status
- Re-verifying
- Defendant
- Comcast Cable Communications LLC / Comcast Corp.
- Settlement fund
- $117,500,000
- Claim deadline
- September 14, 2026
- No-proof cash option
- Yes — "Alternative Cash Payment" option available to Settlement Class Members (exact flat dollar figure listed on FAQ Q9, not re-extracted this session). or up to Reimbursement for documented Out-of-Pocket Losses and Lost Time (FAQ Q8; exact dollar caps not re-extracted this session).
- Max documented payout
- $10,000
- Administrator
- Kroll Settlement Administration LLC
- Official site
- www.comcastbreachsettlement.com
- Court
- United States District Court for the Eastern District of Pennsylvania
- Case number
- 2:23-cv-05039-JMY
Last verified August 21, 2026
Key dates
| Milestone | Date | What it means |
|---|---|---|
| Claim deadline | September 14, 2026(passed) | Last day to file for a payment |
| Opt-out (exclusion) deadline | July 1, 2026(passed) | Last day to leave the settlement and keep the right to sue |
| Objection deadline | None listed | Last day to object to the terms |
| Final approval hearing | August 5, 2026(passed) | When the judge decides whether to approve the settlement |
| Expected payout | Not yet scheduled | Payments are not sent until after final approval and any appeals |
Where to file
Comcast (Xfinity) Data Breach Settlement is administered by Kroll Settlement Administration LLC. The only place to file is the official settlement website:
Verify on the official sitewww.comcastbreachsettlement.com
Filing is free. No legitimate settlement charges a fee to file a claim.
You cannot file on RecordingLaw.com. We are an independent publisher, not the settlement administrator, and we are not affiliated with any court, agency, or defendant.
The court granted final approval of the $117.5 million Comcast Xfinity data breach settlement on August 20, 2026, and the deadline to file a claim was September 14, 2026. If Comcast sent you a breach notice around December 18, 2023, here is what this settlement pays, who is in the class, where payments stand, and what the settlement gives class members for free whether or not they filed anything.
What happened in the Comcast Xfinity breach
Comcast says attackers broke into Xfinity's internal systems between October 16 and October 19, 2023. The company has tied the intrusion to a vulnerability in Citrix networking software that Xfinity used on its network, a flaw that multiple companies were racing to patch around the same time.
Comcast did not notify customers until December 18, 2023, almost two months after the intrusion occurred. That gap between discovery and notice became part of what customers argued in the lawsuit that produced this settlement.
According to Comcast's own breach notification filed with the Washington State Attorney General, the exposed information included customers' names, Social Security numbers, full dates of birth, and Xfinity usernames with passwords or security question answers. Breach-tracking reports describe the Social Security number exposure as limited to the last four digits for many affected customers, though Comcast's own regulatory filings do not break that distinction out. In its final approval memorandum, the court described the settlement class as approximately 31.5 million people.
After the three years of CyEx
A credit freeze at Equifax, Experian, and TransUnion is free and comes first. Every settlement class member can also enroll in three years of free CyEx Financial Shield Complete with the activation code from their notice, no claim form needed, and it includes dark web monitoring and identity theft insurance, so use that before paying for anything. If you want credit monitoring and dark web alerts to keep going once those three years end, Aura is one paid option that offers both.
See What Aura MonitorsAffiliate disclosure: if you sign up through this link we may earn a commission, at no extra cost to you. Learn more
Where the settlement stands
The court granted final approval on August 20, 2026, and the claim filing deadline was September 14, 2026. The case, captioned against Comcast Cable Communications LLC, case number 2:23-cv-05039-JMY, is in the U.S. District Court for the Eastern District of Pennsylvania, the same state whose data breach notification law sets rules for how companies must notify residents of a breach.
The deadline to exclude yourself from the class or object to the settlement passed on July 1, 2026. That deadline did not affect a class member's ability to file a claim. Opting out and filing a claim are two different things, and if you did not opt out, you remain part of the settlement class.
The court held the final approval hearing on August 5, 2026. On August 20, 2026, it granted final approval, overruled all objections, awarded class counsel $31,725,000 in attorneys' fees (27% of the settlement fund), and directed entry of final judgment. No payment date appears in the court's approval order; distributions typically begin only after the judgment becomes final and any appeal period passes.
Who is in the settlement class
The settlement class covers people in the United States and its territories who received an individual notice that their information was involved in the breach Comcast announced in December 2023. In practice, that means current or former Xfinity customers whose account was active around the time of the October 2023 intrusion.
If you are not sure whether you got a notice, the official site lets you check your eligibility using your notice information. You do not need to have the letter or email in hand to look yourself up.
How much you can realistically get: two payment paths
The settlement offered two payment paths, and each claimant could choose only one. The two could not be combined.
The first path is the Alternative Cash Payment. It requires no documentation at all, no receipts, no proof of loss of any kind. The official settlement FAQ estimates this payment at around $50 per claimant, though that figure is subject to pro rata adjustment depending on how many valid claims were filed and the fees and costs the court approved. No specific amount is guaranteed.
The second path is reimbursement for documented Out-of-Pocket Losses and Lost Time, capped at a combined $10,000. Lost time is paid at $30 an hour, up to five hours, in 15-minute increments. Out-of-pocket losses require documentation connecting the loss to this specific breach.
Choosing the documented path means giving up the flat cash payment, and choosing the flat cash payment means giving up the documented path. You receive whichever amount is greater, not both. For most people without significant, well-documented losses, the no-proof cash payment will be the simpler and often the more realistic option. Treat any figure here as an estimate, not a promise, until payments actually go out.
The free identity protection this settlement already gives you
Separate from any cash payment, every settlement class member can enroll in three years of free identity protection and restoration services through CyEx Financial Shield Complete. Per the official FAQ, this benefit does not require filing a claim form. You only need the individualized activation code included in your notice email or letter.
The service includes single-bureau credit monitoring, dark web monitoring, real-time authentication alerts, and up to $1 million in identity theft insurance, plus access to trained agents if you spot suspicious activity. If you are worried about your exposed information, enroll in this free benefit first rather than paying for a commercial identity protection product. The settlement is already giving you one at no cost.
It is also worth placing a free security freeze on your credit file at all three major bureaus, Equifax, Experian, and TransUnion. A freeze is free by federal law, blocks new accounts from being opened in your name, and works whether or not you filed a claim in this settlement.
How to file your claim
Filing did not require a lawyer, and it did not cost anything. The no-proof Alternative Cash Payment claim form asked only for identifying information, with no document upload, while claims for documented losses or lost time required a description of the losses and supporting records. Claims had to be submitted or postmarked by September 14, 2026, and that deadline has passed. If you filed, check your claim status only through the official settlement site, and never pay anyone who offers to speed up or collect a payment for you.
If you are still worried about your data
A free credit freeze and the settlement's own identity protection enrollment cost nothing and take only a few minutes, whether or not you filed a cash claim. You can also report suspected identity theft at IdentityTheft.gov, the Federal Trade Commission's official recovery site, which walks you through recovery steps specific to your situation.
For other open and closed data breach settlements, see RecordingLaw's data breach settlement tracker.
Frequently Asked Questions
Is the Comcast Xfinity data breach settlement still open in 2026?
No. The deadline to file a claim was September 14, 2026. The court granted final approval of the $117.5 million settlement on August 20, 2026, and payments to people who filed valid claims are made only after the judgment becomes final.
Who is eligible for the Comcast Xfinity settlement?
You may be eligible if you are a current or former Xfinity customer who received an individual notice around December 18, 2023 that your personal information was exposed in the October 2023 data breach. The official site lets you check your status even if you no longer have the notice.
How much money will I actually get from the Comcast settlement?
It depends which option you choose and how many people file valid claims, since payments are estimates from a shared fund, not guarantees. The no-proof Alternative Cash Payment is estimated around $50, while documented losses and lost time are capped at a combined $10,000, and most claimants without major documented losses should expect an amount closer to the flat estimate than the ceiling.
What is the difference between the Alternative Cash Payment and a documented loss claim?
The Alternative Cash Payment was a flat amount available with no proof at all, while the documented option reimburses actual out-of-pocket losses and lost time, paid at $30 an hour up to five hours, for claimants who submitted records. Claimants could pick only one path; the settlement pays whichever amount is greater, not both.
Do I need receipts or documentation to file a claim?
No. The Alternative Cash Payment required no documentation at all. Records were needed only for claims of documented out-of-pocket losses or lost time tied to the breach.
Do I have to file a claim to get the free identity protection?
No. According to the official settlement FAQ, all settlement class members can enroll in three years of free identity protection and restoration services using the activation code from their notice, whether or not they ever file a cash claim.
I missed the deadline to opt out of the Comcast settlement. Could I still file a claim?
The deadline to opt out or object passed on July 1, 2026, and that only affected the right to sue separately. Class members who did not opt out remained in the settlement class and could file a claim through the September 14, 2026 claim deadline, which has now also passed.
Is money from the Comcast data breach settlement taxable?
It depends on what the specific payment is meant to replace, such as reimbursed losses versus a general cash payment, so there is no single answer. Consult a tax professional and see the IRS's guidance on settlement taxability for details.
How to tell a settlement notice is real
Check the case name, case number, and court against the official settlement site. Go to that site directly instead of clicking a link in an email or text. Nobody legitimate will call, text, or email out of the blue asking for your Social Security number, bank account, or card details, and nobody will charge you to file. Report anyone who does at ReportFraud.ftc.gov.
Already have a notice with a link or sender address? Paste it into our settlement notice checker to compare it with the official claim sites we track.
Informational only. Not legal, tax, or financial advice, and not affiliated with any settlement.
RecordingLaw.com is an independent legal-information publisher. We are not a law firm, not a settlement administrator, and not affiliated with, endorsed by, or acting on behalf of any court, government agency, defendant, or claims administrator described on this page. Reading this page does not create an attorney-client relationship.
We do not process claims and we never collect your claim information. You cannot file a claim on RecordingLaw.com. To file, opt out, object, or check your status, use only the official settlement administrator identified above. We link to it for your convenience.
Filing a legitimate claim is free. No legitimate settlement or administrator will charge you a fee to file, or ask for your Social Security number, bank, or card details by unsolicited call, text, or email. If someone does, it is likely a scam. Report it at ReportFraud.ftc.gov.
Deadlines, amounts, and approval status change and are set by the court. We verify against the official administrator and court records, but confirm the current details on the official site before acting. Nothing here guarantees eligibility, a payment, or any amount. Settlement payments may be taxable. See IRS Publication 4345. and consult a tax professional. For advice about your specific situation, consult a licensed attorney in your state. Affiliate disclosure.
Updates
Updated to reflect the court's August 20, 2026 final approval of the settlement and the passing of the September 14, 2026 claim deadline, and corrected the class size to the approximately 31.5 million members stated in the court's approval memorandum.
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
United States Code Title 47
§ 551Protection of subscriber privacyIn force
At the time of entering into an agreement to provide any cable service or other service to a subscriber and at least once a year thereafter, a cable operator shall provide notice in the form of a separate, written statement to such subscriber which clearly and conspicuously informs the subscriber of— the nature of personally identifiable information collected or to be collected with respect to the subscriber and the nature of the use of such information; the nature, frequency, and purpose of any disclosure which may be made of such information, including an identification of the types of persons to whom the disclosure may be made; the period during which such information will be maintained by the cable operator; the times and place at which the subscriber may have access to such information in accordance with subsection (d); and the limitations provided by this section with respect to the collection and disclosure of information by a cable operator and the right of the subscriber under subsections (f) and (h) to enforce such limitations.
Official text (excerpt) · last checked 2026-09-14 · Read the full text in our law library · Verify at uscode.house.gov
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Washington State Attorney General, Comcast Cable Communications LLC Data Breach Notice(atg.wa.gov).gov
- IRS, Tax Implications of Settlements and Judgments(irs.gov).gov
- Comcast (Xfinity) Data Breach Settlement, Official Site, Kroll Settlement Administration(comcastbreachsettlement.com)
- Comcast Data Breach Settlement, Frequently Asked Questions(comcastbreachsettlement.com)
- Comcast Data Breach Settlement, Case Documents and Settlement Agreement(comcastbreachsettlement.com)
- In re Comcast Data Breach Litigation, No. 2:23-cv-05039 (E.D. Pa.), Memorandum and Order Granting Final Approval (ECF 321, 322, Aug. 20, 2026)(courtlistener.com)