Comcast Reveals Major Xfinity Data Breach, Says It’s Not Aware Of “Any Attacks On Our Customers”

Jill Goldsmith
·2 min read

Comcast has revealed that a major data breach at Xfinity may have compromised the accounts of close to 36 million accounts. A vulnerability by one of its software providers, Citrix, exposed usernames and hashed passwords and, for some customers, names, contact information, the last four digits of social security numbers, dates of birth and secret questions and answers.

Xfinity is Comcast’s brand name for its broadband, video and phone services. It has 32 million subscribers, some with multiple use IDs.

More from Deadline

In a statement today, Comcast said: “We are providing notice to customers about a data security incident which exploited a vulnerability previously announced by Citrix, a software provider used by Xfinity and thousands of other companies worldwide. We promptly patched and mitigated the vulnerability. We are not aware of any customer data being leaked anywhere, nor of any attacks on our customers. In addition, we required our customers to reset their passwords and we strongly recommend that they enable two-factor or multi-factor authentication, as many Xfinity customers already do.  We take the responsibility to protect our customers very seriously and have our cybersecurity team monitoring 24×7.”

In a previous note, the company said Citrix had announced the vulnerability Oct. 10 for one of its products used by Xfinity. Citrix issued a patch and other guidance but the media giant then discovered there had been unauthorized access of its internal systems from Oct. 17-19, before the fixes.

The company said it notified federal law enforcement and launched an investigation, concluding Dec, 6 that consumer data was breached. It’s continuing to analyze things, meanwhile asking subscribers to change their passwords.

“We know that you trust Xfinity to protect your information, and we can’t emphasize enough how seriously we are taking this matter. We remain committed to continue investing in technology, protocols and experts dedicated to helping to protect your data and keeping you, our customer, safe,” it said.

The vulnerability, called Citrix Bleed, has hit other major companies like Boeing and Toyota. Many states require companies to report data breaches, which is how the news first surfaced.

Best of Deadline

Sign up for Deadline's Newsletter. For the latest news, follow us on Facebook, Twitter, and Instagram.