FOLLOW US

Comcast is inching closer to closing the book on a sweeping legal battle born from a 2023 cyber intrusion that may have exposed sensitive data belonging to more than 30 million current and former customers.

A federal judge in the Eastern District of Pennsylvania last week granted preliminary approval to a proposed $117.5 million settlement, bringing Comcast within striking distance of resolving two dozen class-action lawsuits that have followed the company like a long digital shadow.

What Customers Could Receive

If the agreement survives a final court review, affected customers would be offered a menu of remedies:

• Three years of financial monitoring and identity theft protection

• A choice between reimbursement for documented losses up to $10,000 or a $50 cash payment

The deal represents a fork in the road: proof-based compensation for those who can document harm, or a flat payout for those who cannot.

Comcast Denies Liability

Comcast did not oppose preliminary approval of the settlement. But in court filings, the Philadelphia-based telecommunications giant made clear it disputes the plaintiffs’ version of events and denies any legal responsibility for the breach.

Neither Comcast representatives nor its legal team responded to requests for comment.

Lawsuits Rolled Into One Arena

The settlement would resolve 24 lawsuits filed in federal courts across the country, all consolidated before a single judge in Philadelphia — a legal funnel narrowing years of litigation into one decisive moment.

At the center of the dispute is a data breach that occurred between Oct. 16 and Oct. 19, 2023, when hackers accessed Comcast’s internal systems.

A Missed Patch, a Wide-Open Door

Court records say the breach stemmed from a delayed software fix. Comcast had not yet applied a security patch addressing a vulnerability in Citrix Systems software — a digital lock that, once weakened, gave hackers a way inside.

Citrix had issued a warning and provided guidance in an Oct. 10 bulletin, according to filings. Plaintiffs argue Comcast failed to act quickly enough, allowing attackers to exploit the gap like burglars finding an unlocked door.

Data Potentially Exposed

The breach may have compromised a broad swath of customer information, including usernames, passwords, names, contact details, security questions and answers, and the last four digits of Social Security numbers for more than 30 million people, court documents state.

The scale of exposure transformed what might have been a routine cyber incident into a national legal firestorm.

How the Deal Came Together

The settlement emerged after a negotiation session in November, following several unsuccessful mediation efforts. It was a breakthrough after months of stalled talks.

Under the proposal, the $117.5 million fund would cover customer compensation, administrative costs for notifying class members and processing claims, and attorneys’ fees.

Court filings indicate class counsel could receive up to one-third of the total settlement, though the precise figure will be determined later.

What Happens Next

U.S. District Judge John Milton Young has scheduled a final approval hearing for July. If the settlement is approved, Comcast and Citrix would be released from all claims tied to the breach — a legal full stop after years of uncertainty.

For millions of customers, Comcast's $117.5M Data Breach Deal may mark the end of a digital scare that spread faster than the malware that sparked it.