Xfinity data breach impacts over 35 million customers

[Shawn Knight]

How we got here: Comcast's Xfinity has disclosed a security breach impacting nearly 36 million customers. The breach occurred between October 16 and October 19 of this year but for the full story, we need to backtrack a bit.

On October 10, cloud service provider Citrix announced a vulnerability impacting software used by Xfinity and "thousands of other companies" around the globe.

It'd be nearly two more weeks – on October 23 – before Citrix shared additional mitigation guidance. Xfinity said it promptly patched and mitigated the vulnerability in its systems but on October 25 during a routine cybersecurity exercise, they discovered unauthorized access to their system that took place a week earlier using the vulnerability.

In a separate filing with the Maine AG, Comcast said the breach impacted 35,879,455 people.

Xfinity's investigation showed that customer information including usernames, hashed passwords, legal names, contact information, the last four of Social Security numbers, dates of birth and / or security questions and answers were compromised. The company said it is still looking into the matter, so it's possible that additional data was compromised.

Xfinity is requiring customers to reset their account passwords, and strongly recommends enabling two-factor authentication. The ISP also advises against re-using passwords across multiple accounts and services; if you have used your Xfinity password elsewhere, be sure and change those also.

Related reading: The worst passwords of 2023 are also the most common, "123456" comes in first

Notably, the company made no mention of any complimentary credit monitoring service being offered to impacted customers. Such offers are common with high-profile data intrusions although since this one did not involve credit card information, perhaps that is why Xfinity is not offering it.

Comcast is no stranger to security incidents. Back in 2018, it was discovered that a Comcast site used to activate Xfinity routers was sharing personal data including home addresses, Wi-Fi network names, and passwords.

Those with additional questions are encouraged to check Xfinity's data breach incident report or reach out directly to the company.

Image credit: Negative Space

Permalink to story.

https://www.techspot.com/news/101270-xfinity-data-breach-impacted-358-million-customers.html

 

[Athlonite]

Comcast's Xfinity has disclosed a security breach impacting more than 36 million customers. Is a contradiction to the actual amount that comcast said were impacted "Comcast said the breach impacted 35,879,455 people."

 

[Superconductor]

Comcast's Xfinity has disclosed a security breach impacting more than 36 million customers. Is a contradiction to the actual amount that comcast said were impacted "Comcast said the breach impacted 35,879,455 people."

Huh?

 

[umeng2002]

What are you going to do? Switch to another cable company? hahahahahahahahaaa...

 

[Neatfeatguy]

Shithappens in the security world of online stuff.

It just would have been nice if Xfinity - who is prompt at taking payment without a fault - would have informed their customers. I've seen no email or snail-mail notification of this breech.

What a shitty company.

 

[imdarkbreeze]

I got no notification either, but last week when I logged in to check some billing information I sure as heck was forced, not given the option, FORCED, to change my password. No indication of why, just "we periodically require users to change their.........blah, blah, blah".

BS. I've been a Comcast/Xfinity customer since 1997 when it was called Comcast @Home and this is the first time EVER they've required me to change it. I mean, I've changed it periodically through the years, but not because they insisted on it or required it. Liars in both directions.

 

[Neatfeatguy]

I got no notification either, but last week when I logged in to check some billing information I sure as heck was forced, not given the option, FORCED, to change my password. No indication of why, just "we periodically require users to change their.........blah, blah, blah".

BS. I've been a Comcast/Xfinity customer since 1997 when it was called Comcast @Home and this is the first time EVER they've required me to change it. I mean, I've changed it periodically through the years, but not because they insisted on it or required it. Liars in both directions.

I don't check my xfinity email (the one they give you when you make an account) and when I say I don't check it it's been years since I last did. So, I logged into my Xfinity account (had to change my password) and went into my xfinity email I had emails back from March 2018 that I hadn't looked at.

Anyway, the most recent email to that specific account was from April of 2022. So, no, Xfinity didn't notify their customers in any way, shape or form about this. Not even an email to their customers on their internal email system. That's just F'ed up.