Comcast Class Action Lawsuit
The lawsuit says Comcast was too slow to patch a known security flaw called Citrix Bleed, and that hackers used it to take personal data on more than 30 million customers.
What happens next with the Comcast settlement
The claim deadline passed on September 14, 2026. New claims for this settlement are no longer being accepted.
The court approved the settlement on August 20, 2026. Payments are sent once that approval is final: after the time for anyone to appeal it runs out, or after any appeal ends.
Then the payments go out. The settlement administrator, the firm the court appointed to process claims, sends payments to eligible claimants once it has reviewed the claims. How long that takes varies from one settlement to the next.
Filed this claim with Chimo? The status of your claim is on the claims page in your account.
Settlements you can still claim in November 2026
Laboratory Services Cooperative
$50
Jefferson-Blount-St. Clair Mental Health Authority
$100
UFCW Local 7
$50
Comcast Class Action Lawsuit
In December 2023, Comcast emailed or mailed more than 30 million current and former customers to say that hackers had taken their personal information. The data included names, contact details, dates of birth, the last four digits of Social Security numbers, usernames and passwords, and security questions and answers.
The lawsuit says the hackers got in through Citrix Bleed, a flaw in Citrix's NetScaler software that Comcast used. Citrix released a fix on October 10, 2023. According to the complaint, Comcast did not apply it until more than a week later, and attackers were inside its systems from October 16 to October 19, 2023.
Kenneth Hasson filed the first complaint on December 19, 2023, the day after Comcast announced the breach. More than 20 related cases followed in six states. They were combined into one case before Judge John Milton Younge in the U.S. District Court for the Eastern District of Pennsylvania (case number 2:23-cv-05039-JMY). The combined complaint makes 23 legal claims, including negligence, breach of an implied contract, violations of state consumer-protection laws and a violation of the federal Cable Communications Policy Act, a law that limits what cable companies can do with subscribers' personal information.
The court appointed Gary F. Lynch of Lynch Carpenter LLP and Norman E. Siegel of Stueve Siegel Hanson LLP to lead the case as class counsel, the lawyers who represent everyone in the class.
Comcast Class Action Settlement - $117,500,000
Comcast agreed to pay $117.5 million into a settlement fund to end the lawsuit. Comcast denies any wrongdoing. None of the money goes back to Comcast, whatever happens to it.
The settlement covers about 31.7 million people who received Comcast's breach notice on or around December 18, 2023. It also ends related cases in California and Pennsylvania state courts.
Before anything is paid to claimants, the fund covers the lawyers' fees and expenses, awards to the named plaintiffs (the 11 people who brought the case on behalf of everyone else), the cost of three years of identity-protection service for every class member, and up to $7.3 million of notice and administration costs. Comcast pays any administration costs above $7.3 million separately. What is left pays the cash claims.
The court moved the claim deadline from August 14 to September 14, 2026, and the claim form was reissued with the new date. That deadline has passed, and new claims can no longer be filed.
Comcast Settlement Fund
Total fund
Cash component
Identity protection
$117,500,000; no money returns to Comcast
Up to $10,000 for documented losses and lost time, or a $50 alternative payment
Three years of CyEx Financial Shield Complete, for every class member
Claims closed: September 14, 2026
Comcast Class Action Payout: $50 - $10,000
Class members could make one of two cash claims, but not both.
The first was a documented claim, worth up to $10,000. It covered money people lost because of the breach, such as fraud charges no one refunded, credit-freeze fees and credit-monitoring subscriptions. It also covered up to five hours of time spent dealing with the breach, paid at $30 an hour.
The second was a $50 payment that needed no paperwork. If valid claims add up to more than the money available, every payment is reduced by the same percentage. That is what the settlement means by a pro rata adjustment.
Every class member can also enroll in three years of CyEx Financial Shield Complete, whether or not they filed a claim. It includes credit monitoring at one credit bureau, dark-web monitoring, $1 million of identity-theft insurance, and help from a specialist if your identity is stolen. Enrolling takes the activation code printed on the settlement email or postcard. Once the settlement is final, the settlement administrator emails instructions to anyone who has not enrolled yet.
The court held its final hearing on August 5, 2026, and approved the settlement on August 20. People who filed online could choose PayPal, Venmo, Zelle, a bank transfer or a paper check. Questions about a payment go to the settlement administrator at (833) 319-2401.
Comcast Class Action Eligibility
You are in the class if Comcast sent you a notice, on or around December 18, 2023, saying your personal information may have been taken in the October 2023 Citrix Bleed breach. That covers about 31.7 million current and former customers living in the United States and its territories.
The claim form asked for:
- The Settlement Class Member ID printed on your email or postcard notice.
- Your choice of payment: a claim for documented losses and lost time, or the $50 payment. You could not choose both.
- For documented losses, proof such as credit-card or bank statements, invoices, phone records or receipts. Handwritten or self-made receipts were not enough on their own.
- For lost time, a short explanation, in your own words, of how you spent up to five hours dealing with the breach.
You also signed the form, swearing under penalty of perjury that everything on it was true. Claims are checked against the company's records. A false claim can be cut back or thrown out, and large-scale false filing can be prosecuted. A smaller claim that is accurate is the one that gets paid.
FAQ
The attackers got in through Citrix Bleed, a flaw in Citrix's NetScaler software that Comcast used. Cloud Software Group owns Citrix. The plaintiffs say Comcast was at fault for patching too slowly and Citrix for the flaw itself. The settlement ends the claims against all three companies.
Citrix Bleed is the nickname for CVE-2023-4966, a flaw that let attackers take over a user's session that was already logged in on Citrix NetScaler software. Citrix released a fix on October 10, 2023. According to the complaint, Comcast did not apply it until more than a week later, and attackers were in Comcast's systems from October 16 to October 19, 2023.
Class counsel, the lawyers appointed to represent the class, asked the court for one-third of the fund, about $39.17 million, plus their expenses. In August 2026 the court awarded $31,725,000 instead, which is 27% of the fund. Fees are paid out of the $117.5 million.
The named plaintiffs are the 11 people who brought the case on behalf of everyone else: Patricia Andros, Michelle Birnie, Jessica Durham, Ryan Emmett, Vince Estevez, Alexander Nunn, Steven Prescott, Robert Smith, Veronica Verdier, Marcia Proto Wilson and Jodi Wolfson. The court approved $5,000 for each of them, $55,000 in total, paid out of the fund.
More than 20 related cases were filed in federal courts in Pennsylvania, Florida, Illinois, South Carolina, Nevada and Minnesota in the weeks after Comcast announced the breach in December 2023. They were combined before Judge Younge in Pennsylvania. This settlement also ends related cases in California and Pennsylvania state courts.
None of it goes back to Comcast. Money left over, for example from checks nobody cashes or payments held back because the tax details were never sent, is shared among other class members, used to extend the identity-protection service, or spent however the court orders.
That cost could be claimed as a documented loss if you paid it on or after October 16, 2023, and could show a credit-card statement, invoice or receipt for it. Records you made yourself were not enough on their own.
Comcast denies any wrongdoing. Besides the $117.5 million, it agreed to pay any notice and administration costs above $7.3 million, so those costs cannot eat further into the fund. Settling also ended Comcast's argument that the plaintiffs had not been harmed enough to sue, which could have ended the case before it went any further.
Arbitration is a private alternative to a lawsuit. You are not in this settlement if, before December 23, 2025, you filed a written arbitration demand against Comcast over the breach, gave Comcast written notice that a lawyer represented you in one, or signed a release giving up those claims. People in that group keep their own arbitration rights and are not bound by this settlement.
Sources
These are the court's own records for this case. They are hosted here unchanged, so you can check anything on this page against the documents themselves.
- Comcast Data Breach Consolidated Class Action Complaint (PDF) Complaint · Filed July 1, 2024 · U.S. District Court for the Eastern District of Pennsylvania · Case 2:23-cv-05039-JMY
- Comcast Data Breach Class Action Settlement Agreement and Release of Claims Against Comcast (PDF) Settlement agreement · Filed December 23, 2025 · U.S. District Court for the Eastern District of Pennsylvania · Case 2:23-cv-05039-JMY
- Comcast Data Breach Class Action Preliminary Approval Order (PDF) Court order · Filed January 16, 2026 · U.S. District Court for the Eastern District of Pennsylvania · Case 2:23-cv-05039-JMY
- Comcast Data Breach Order Granting Final Approval of Class Action Settlement (PDF) Court order · Filed August 20, 2026 · U.S. District Court for the Eastern District of Pennsylvania · Case 2:23-cv-05039-JMY
The full case file is on the court docket: view the docket.