Your holiday present from Comcast has arrived, in the form of a massive data breach that has compromised the personal information of nearly 36 million customers. Comcast released a statement on Monday this week stating that a “recent data security incident” occurred involving Citrix software.
“On October 10, 2023, Citrix announced a vulnerability in software used by Xfinity and thousands of other companies worldwide,” Comcast wrote.
“Citrix issued additional mitigation guidance on October 23, 2023. Xfinity promptly patched and mitigated the Citrix vulnerability within its systems. However, during a routine cybersecurity exercise on October 25, Xfinity discovered suspicious activity and subsequently determined that between October 16 and October 19, 2023, there was unauthorized access to its internal systems that was concluded to be a result of this vulnerability.”
“Xfinity notified federal law enforcement and initiated an investigation into the nature and scope of the incident. On November 16, Xfinity determined that information was likely acquired,” the release said.
“After additional review of the affected systems and data, Xfinity concluded on December 6, 2023, that the customer information in scope included usernames and hashed passwords; for some customers, other information may also have been included, such as names, contact information, last four digits of social security numbers, dates of birth and/or secret questions and answers.”
So, everything?
Conveniently not included in the release but disclosed in follow up reporting by PhillyBurbs.com was the fact that over 35.8 million customers were affected by the breach, according to a report with Maine’s Attorney General.
Comcast has said it is requiring all of its customers to reset their passwords and that it is encouraging its users to use 2FA in the future.
“Xfinity advises customers not to re-use passwords across multiple accounts, the company is recommending that customers change passwords for other accounts for which they use the same username and password or security question,” the release said.
Just in case you didn’t have anything to do heading into the holidays…