Comcast facing multiple class action lawsuits related to Xfinity data breach

In December, Xfinity, a Comcast-owned telecommunications company, notified customers about a data breach that compromised the personal information of nearly 36 million people between Oct. 16 and Oct. 19, 2023.

Xfinity said in a Dec. 18 notice to customers that hackers gained unauthorized access to internal systems by exploiting a vulnerability in software used by the company. The information that was compromised included usernames, hashed passwords, which scrambles data to safeguard information, and for some customers, the last four digits of Social Security numbers, account security questions, birthdates and contact information.

VERIFY readers Donna and Joe said they have seen ads from law firms about class action lawsuits related to the breach, and asked if these ads are scams or legit.

THE QUESTION

Is there a class action lawsuit against Comcast in response to the Xfinity data breach?

THE SOURCES

• Court documents found on Public Access to Court Electronic Records (PACER)
• ClassAction.org
• Top Class Actions
• Milberg, a class action law firm

THE ANSWER

Yes, multiple class action lawsuits have been filed against Comcast in response to the Xfinity data breach.

Sign up for the VERIFY Fast Facts newsletter here. 

WHAT WE FOUND

Multiple class action lawsuits have been filed against Comcast over the Xfinity data breach in October 2023. VERIFY found at least five cases filed by several law firms on behalf of affected customers as of Jan. 24, 2024.

One of the first lawsuits was filed in Pennsylvania on Dec. 19, 2023, just one day after Xfinity alerted customers about the data breach, according to court documents found via PACER. The lawsuit alleges that Comcast failed to take adequate cybersecurity measures to protect customers’ sensitive information, Top Class Actions says. Within that same week, two more lawsuits were filed against the company in Pennsylvania on Dec. 21 and Dec. 22, 2023.

A few days later on Dec. 26, 2023, Milberg, a class action law firm, filed a lawsuit in Florida on behalf of Comcast customers affected by the data breach. The complaint, which names Comcast and its software provider Citrix Systems Inc. as defendants, also alleges that the companies failed “to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect Comcast’s customers’ personal identifying information (PII) from a foreseeable and preventable cyberattack.”

Court records show another lawsuit was filed against Comcast and Citrix in Florida on Jan. 17, 2024. It also claims that Comcast failed to adequately secure and protect the PII of its customers during the October 2023 data breach, according to Top Class Actions. The plaintiff is demanding a jury trial and requesting declaratory and injunctive relief along with an award of damages for himself and all class members.

Milberg says any Comcast customer who received a data breach letter from the company may be automatically able to join its lawsuit. Click here to contact the law firm about the case.

If all parties in these class action lawsuits eventually reach a settlement, people who were affected by the data breach may be eligible to receive compensation.

Attorneys at Milberg are also currently gathering people to file a mass arbitration against Comcast over the data breach, according to ClassAction.org. A mass arbitration, which is not the same as a class action lawsuit, happens “when hundreds or thousands of consumers file individual arbitration claims against the same company over the same issue, all at the same time,” ClassAction.org says. If you were affected by the breach, you can fill out this form to sign up for the mass arbitration.

The Associated Press contributed to this report.