PHILADELPHIA, April 14, 2026, 08:02 EDT
Comcast users hit by the 2023 Xfinity data breach have until Aug. 14 to submit claims for cash or services from a $117.5 million settlement. The final green light on the deal is scheduled for July 7 in federal court in Philadelphia.
About 31.6 million people who received breach notifications make up the class. Anyone who can document out-of-pocket expenses and lost time is eligible to claim up to $10,000 per individual; lost time is compensated at $30 per hour, up to a five-hour limit. Others in the class can file for a cash payment, estimated around $50. On top of that, all class members qualify for three years of identity-defense protection, which comes with credit monitoring, dark web surveillance, and identity theft insurance with up to $1 million in coverage.
The start of the claims process is significant—the big telecom privacy suit now shifts from legal wrangling to actual payouts for consumers. It comes as the sector grapples with the costly aftermath of cyber breaches: AT&T secured early court sign-off on a $177 million data breach deal last year, and T-Mobile, hit by its own incident, agreed in 2022 to a $350 million settlement, plus another $150 million earmarked for security upgrades.
Comcast maintains it did nothing wrong. In a December 2023 customer alert, Xfinity pointed to a Citrix software vulnerability disclosed on Oct. 10, 2023 as the entry point for unauthorized access into certain internal systems from Oct. 16 to Oct. 19. The company said attackers may have obtained usernames and scrambled password data, plus—depending on the individual—names, contact information, birth dates, security questions and answers, and the last four digits of Social Security numbers.
U.S. District Judge John Milton Younge gave the green light for preliminary approval back in January, setting a final hearing for 10:00 a.m. ET on July 7 at Philadelphia’s James A. Byrne Courthouse. According to the court-approved settlement site, the class covers customers who received breach notifications around Dec. 18, 2023.
Last month, Steven Weisman—Bentley University professor and founder of Scamicide.com—called the exposure of only the last four digits of a Social Security number “really is a big deal.” Criminals, he said, often piece together partial identifiers like those four digits with other stolen information, enabling identity theft or more precise phishing schemes. WJAR
Online claims must be submitted by 11:59 p.m. ET on Aug. 14, or sent by mail if they’re postmarked that day. Customers who skip the process won’t see a cash payout and will forfeit any right to sue over these settlement claims. But, the FAQ notes, they’ll still be able to activate identity-defense and restoration services once the deal is finalized.
The headline payout numbers aren’t set in stone. According to the FAQ, actual cash payments will draw from what’s left after notice and admin costs, legal fees, service awards, and identity-defense expenses. Class counsel is eyeing up to a third of the fund—$39.17 million—plus their expenses. Should the valid claims overshoot what’s available, payments get trimmed proportionally. If claims end up sparse, any surplus could be funneled back into extended services or split among claimants, but won’t go back to Comcast.
So, predicting exactly how much each person will get isn’t easy. According to an FTC staff study referenced by Reuters, the typical claims rate in 149 consumer class actions was 9%—with the weighted average even lower, at 4%. Once notices are sent, turnout often jumps around.
If customers want to opt out or object, they’ll need to do so by June 1. The settlement website notes that payments won’t be made unless there’s final approval and all appeals are finished.
