In October 2023, attackers accessed Xfinity systems and may have acquired customer information, including usernames and hashed passwords. A Maine attorney-general filing reported nearly 35.9 million affected user IDs, a figure widely rounded to about 36 million; Comcast did not confirm a specific total to The Associated Press. The breach does not by itself prove that any particular customer’s information was misused.
What happened in the Xfinity data breach?
Xfinity’s incident notice traced the event to a vulnerability that Citrix announced on October 10, 2023. Xfinity said unauthorized access took place from October 16 through October 19. On November 16, the company determined that information was likely acquired. On December 6, it concluded that usernames and hashed passwords were involved and said its analysis was continuing.
| Date | What Xfinity reported |
|---|---|
| October 10, 2023 | Citrix announced the vulnerability. |
| October 16–19, 2023 | Unauthorized access occurred before mitigation. |
| November 16, 2023 | Xfinity determined information was likely acquired. |
| December 6, 2023 | Xfinity concluded usernames and hashed passwords were involved; analysis was continuing. |
How many customers were affected?
The Maine attorney-general filing disclosed nearly 35.9 million affected user IDs, according to The Associated Press. The U.S. Army Cyber Directorate separately described the incident as affecting approximately 36 million customers in a December 20, 2023 flyer. These are filing- and agency-based figures: Comcast did not confirm a specific number to AP, and an affected user ID is not necessarily the same measure as a unique person.
What information may have been exposed?
Xfinity said usernames and hashed passwords were involved. Depending on the customer, the information also included one or more of the following:
#1 Best Overall
- MAXIMIZE YOUR CABLE INTERNET AND WHOLE-HOME WIFI: A cable modem and WiFi router in one device unlocks the full potential of your home internet with faster downloads, smoother WiFi for gaming and video calls, and reliable coverage in every room.
- APPROVED FOR YOUR PROVIDER AND PLAN: Works with Xfinity internet plans up to 800Mbps, Spectrum up to 1Gbps, and Cox up to 1Gbps. Not compatible with Verizon, AT&T, CenturyLink, DirecTV, DISH, or bundled voice plans. ISP activation required after setup.
- MULTI-GIG DOCSIS 3.1 SPEEDS: Get Gigabit+ cable download speeds on today's fastest plans, with headroom for the upgrades ahead. Real-world speeds depend on your plan and ISP network.
- WIFI 6 COVERAGE FOR THE WHOLE HOME: Stay connected in every room with dual-band AX2700 WiFi 6 covering up to 2,000 sq ft and capacity for 25+ connected devices. Real-world coverage depends on home size, layout, and building materials.
- WIRED CONNECTIONS FOR YOUR FASTEST DEVICES: Four Gigabit Ethernet ports keep gaming consoles, desktops, and streaming devices hardwired for the lowest latency and the most stable connection in your home.
- Name and contact information
- The last four digits of a Social Security number
- Date of birth
- Secret questions and answers
The notice did not say that every affected account contained every listed data type. A hashed password is not the same as a plain-text password, but that does not make password reuse safe: change the Xfinity password and any reused password elsewhere.
Was your Xfinity account hacked?
The public incident information establishes that Xfinity accounts were affected, but it does not establish whether a particular person’s account was among them. Xfinity’s compromised-ID guidance says a potentially compromised Xfinity ID may be disabled until it is reset. If you cannot sign in, follow Xfinity’s reset process. After regaining access, check for unexpected account activity rather than assuming that a breach notice proves someone used your account.
Rank #2
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
- Review the account for unfamiliar users, unrecognized charges, or service changes.
- Check notices about account changes that you did not make.
- Review voice and voicemail PINs, and remove unfamiliar recovery email addresses or phone numbers.
- Change any password reused on another service, not just the Xfinity password.
What should you do after the breach?
Secure the Xfinity account
Reset the password if Xfinity requires it or the account may be compromised. Use a unique password, and enable two-factor or multi-factor authentication (MFA); Xfinity specifically encouraged customers to enroll. MFA adds a sign-in check beyond the password, so a stolen or reused password alone is less likely to be enough to access the account.
Protect other accounts and watch for misuse
If you reused the Xfinity password, change it on every other account where it was used. Use a different password for each service. Monitor financial and other important accounts, and review your credit reports for unfamiliar activity. The Army Cyber Directorate also advises considering a free credit freeze or fraud alert, keeping software updated, and treating unsolicited calls or emails that ask for personal information as suspicious.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Compatible with major cable internet providers including Xfinity and Cox. NOT compatible with Verizon, Spectrum, AT&T, CenturyLink, DSL providers, DirecTV, DISH and any bundled voice service. Best for cable provider plans up to 800Mbps.
A credit freeze and a fraud alert are defensive options, not evidence that identity theft occurred. The Army’s guidance recommends considering them; the incident notice does not say that every affected customer needs either one.
How can you strengthen sign-in security?
For Xfinity, follow the MFA methods the account supports and choose an option you can reliably use. An authenticator app or text-message code is stronger than relying on a password alone. A compatible physical security key using FIDO2/WebAuthn can provide phishing-resistant MFA, but check that both the account and your devices support the key before buying or relying on one.
Rank #4
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
| Option | Coverage | Security consideration |
|---|---|---|
| Unique password plus MFA on Xfinity | Protects the Xfinity account where enabled; does not automatically protect other accounts that reused the old password. | MFA adds a second sign-in check. Available methods depend on account support. |
| Change reused passwords and enable MFA on other services | Extends protection to each reused credential and each account where MFA is enabled. | Use a distinct password for every service; changing only Xfinity’s password leaves reused credentials elsewhere unchanged. |
| Compatible FIDO2/WebAuthn security key | Can be used only with services and devices that support it. | Offers phishing-resistant MFA; verify compatibility before use. |
Is the Comcast settlement real, and can you still file?
The case is Hasson v. Comcast Cable Communications LLC, Eastern District of Pennsylvania, Case No. 2:23-cv-05039-JMY. The court-approved settlement website says the court approved the settlement on August 20, 2026, and establishes a $117,500,000 settlement fund. The claims administrator listed September 14, 2026 as the claim deadline. That deadline has passed; check the settlement administrator for any updated status or instructions rather than assuming claims are still open.
The settlement FAQ describes benefits for eligible class members. It lists reimbursement for documented out-of-pocket losses, a lost-time claim at $30 per hour for up to five hours, or an estimated $50 alternative cash payment subject to pro rata adjustment. These are different claim options, not guaranteed individual payouts; eligibility and any payment depend on the settlement terms and claims process.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
- CABLE INTERNET AND WIFI MADE FOR YOUR HOME: This two-in-one cable modem and WiFi router puts every setting in your hands, from your WiFi names and passwords to how your network runs, so it works the way your household needs.
- APPROVED FOR YOUR PROVIDER AND PLAN: Works with Xfinity internet plans up to 800Mbps and Cox plans up to 500Mbps. Not compatible with Verizon, AT&T, CenturyLink, DirecTV, DISH, or bundled voice plans. ISP activation required after setup.
- GET THE FULL SPEED OF PLANS UP TO 800 MBPS: DOCSIS 3.0 delivers plenty of speed for HD and 4K streaming, online gaming, and video calls across your home. Actual speeds vary by plan and provider.
- AC1900 WIFI COVERAGE FOR THE WHOLE HOME: Stay connected in every room with dual-band AC1900 WiFi covering up to 1,800 sq ft and Beamforming+ for stronger signal to mobile devices. Real-world coverage depends on home size, layout, and building materials.
- WIRED CONNECTIONS FOR YOUR FASTEST DEVICES: Four Gigabit Ethernet ports keep gaming consoles, desktops, and streaming devices hardwired for the lowest latency and the most stable connection in your home.
Eligible class members also receive three years of CyEx Financial Shield Complete. The described service includes one-bureau credit monitoring, dark-web monitoring, real-time authentication alerts, high-risk transaction monitoring, lost-wallet protection, $1 million identity-theft insurance, security-freeze assistance, victim assistance, financial-transaction monitoring, monthly credit-score tracking, fictitious-identity monitoring, bank and financial-account monitoring, address-change monitoring, home-title monitoring, and trained customer-service support. Check the administrator’s current information for eligibility and enrollment details.
What the breach does—and does not—show
Xfinity said it was not aware of customer data being leaked publicly or of attacks on customers, as reported by The Associated Press in December 2023. That statement does not establish that no information was acquired or that misuse could never occur; Xfinity had already said information was likely acquired. The practical response is to secure reused credentials, enable MFA, and monitor accounts without treating the breach alone as proof of identity theft.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
