PHILADELPHIA, April 14, 2026, 08:02 EDT
Comcast customers affected by a 2023 Xfinity data breach can now file claims under a $117.5 million class-action settlement, with an Aug. 14 deadline to seek cash or services. A final approval hearing is set for July 7 in federal court in Philadelphia.
Roughly 31.6 million people who were sent breach notices are in the class. Those with documented out-of-pocket losses and lost time can seek reimbursement capped at $10,000 per person; lost time itself is reimbursed at $30 an hour for up to five hours, while other claimants can request a cash payment estimated at $50. All class members can also enroll in three years of identity-defense services that include credit monitoring, dark web monitoring and up to $1 million in identity theft insurance.
The claims opening matters because it moves a large telecom privacy case from the courthouse into a live payout process for consumers. It also lands as telecom groups keep absorbing expensive fallout from cyber incidents: AT&T won preliminary approval last year for a $177 million data-breach settlement, while T-Mobile agreed in 2022 to pay $350 million and spend another $150 million on security after a separate hack.
Comcast denies wrongdoing. In its December 2023 notice to customers, Xfinity said a security flaw disclosed by software supplier Citrix on Oct. 10, 2023 led to unauthorized access to some internal systems between Oct. 16 and Oct. 19; the company said the exposed data included usernames and scrambled password data, and for some people names, contact details, dates of birth, secret questions and answers, and the last four digits of Social Security numbers.
U.S. District Judge John Milton Younge granted preliminary approval in January and scheduled a final hearing for 10:00 a.m. ET on July 7 at the James A. Byrne Courthouse in Philadelphia. The court-authorized settlement website says customers who were sent breach notices on or around Dec. 18, 2023 are included in the class.
Steven Weisman, a Bentley University professor and creator of Scamicide.com, said last month that exposure of just the last four digits of a Social Security number “really is a big deal.” He said criminals can combine partial identifiers with other stolen data to carry out identity theft or targeted phishing attacks. WJAR
Claims can be filed online until 11:59 p.m. ET on Aug. 14 or mailed if postmarked by that date. Customers who do nothing will not receive a cash payment and will waive the right to sue over the claims covered by the settlement, though the FAQ says they can still activate identity-defense and restoration services once the deal becomes final.
But the headline payout figures are not guarantees. The FAQ says cash claims will be paid from the net fund after notice and administration costs, service awards, legal fees and the cost of identity-defense services; class counsel plans to seek up to one-third of the fund, or $39.17 million, plus expenses. If valid claims outstrip the money left, payments will be cut on a pro rata — proportional — basis, and if claims come in light, leftover money can be redistributed or used to extend services rather than returning to Comcast.
That makes the final per-person cash payment hard to forecast. An FTC staff study cited by Reuters found a median claims rate of 9% and a weighted mean of 4% across 149 consumer class actions, a reminder that participation can swing sharply once notices go out.
Customers who want to opt out or object must act by June 1. Any payments will come only after final approval and any appeals are resolved, the settlement website says.
