Comcast Xfinity Data Breach Settlement: $117.5M for Customer Privacy Loss

In October 2023, hackers accessed certain Comcast Xfinity customer information without authorization, with the intrusion occurring between October 16 and October 19. Comcast later disclosed the cybersecurity incident in December 2023 and mailed or emailed notices to millions of customers—around 36 million people nationwide—informing them that their personal data may have been compromised. The resulting case, Hasson v. Comcast Cable Communications, LLC (in federal court in Pennsylvania), was resolved through a $117.5 million class action settlement, with Comcast denying wrongdoing and liability as part of the agreement. The lawsuit was filed to address customer privacy and related harms tied to the breach and to provide a structured way for affected people to seek compensation. Most claimants can request an estimated $50 “alternative cash payment,” with identity verification tied to a Class Member ID from the notice; people who can document specific out-of-pocket expenses (such as costs connected to fraud, identity theft, or protective measures) may seek reimbursement up to a combined cap of $10,000, and some claimants can also request payment for lost time. Significantly, the settlement also includes free identity-protection services for eligible class members—helpful even for people who choose not to submit a claim—reflecting the growing expectation that companies should help mitigate downstream impacts after a data incident, within a legal environment shaped by privacy laws, state breach-notification rules, and enforcement by regulators like the FTC. Broader implications extend beyond Comcast: large telecom and digital-service companies are recurring targets, and class actions often test how courts handle claims of inadequate security, disclosure practices, and the extent to which customers must prove financial or time-based losses. Similar cases across the technology and consumer-data industries frequently converge on themes like “reasonable security” expectations, settlement-driven compensation versus proof-heavy damages, and compliance pressures under regulations such as breach-notification obligations and broader privacy/security frameworks that inform company policies and incident response. For customers, this settlement highlights both the importance of safeguarding personal information and the reality that compensation—whether modest or tied to documented losses—often depends on filing deadlines, documentation standards, and how courts view the evidence of harm in the aftermath of a breach.