Millions of current and former Xfinity customers have a narrow window to claim a payment tied to a 2023 data breach, and the clock runs out in mid-September. A $117.5 million class-action settlement resolves claims over an intrusion that exposed personal information for an estimated 35.8 million Comcast customers. Eligible people can file for a flat $50 cash payment, or seek more if they can document out-of-pocket losses, but only if they submit a claim by the deadline.
What the 2023 breach exposed
The settlement stems from a data breach at Comcast’s Xfinity service over a three-day stretch, October 16 through 19, 2023. According to the case, the exposed data included names, contact information, dates of birth, partial Social Security numbers, secured passwords, and answers to security questions. That combination is the kind of information identity thieves prize, because it can help them impersonate a person or answer verification prompts at other accounts.
An estimated 35.8 million customers had data caught up in the incident. The lawsuit that followed accused Comcast of failing to adequately protect that information, and the company agreed to a $117.5 million fund to resolve the claims without admitting wrongdoing, which is standard in settlements of this kind. The mix of exposed fields is what elevates this from a routine leak. A partial Social Security number paired with a date of birth and a security-question answer gives a fraudster several of the building blocks needed to open accounts or take over existing ones, and secured passwords, even when encrypted, are a reason to change reused credentials elsewhere.
Free retirement updates: Miss an enrollment or claim deadline and it may be gone. Our free Retirement Shield newsletter keeps readers ahead of the ones that matter. Get the free newsletter.
Who can file and what a claim is worth
Eligibility runs to current and former Xfinity customers whose information was part of the breach. Those who qualify face a choice between two payment paths. The first is a flat $50 cash payment, which requires no receipts or proof of harm beyond confirming eligibility. The second is a reimbursement of up to $10,000 for documented out-of-pocket losses or time spent dealing with the fallout, such as fraudulent charges, fees, or hours lost resolving identity problems.
For most people who never traced a specific loss to the breach, the flat $50 is the straightforward option. The larger payout is meant for the smaller group who can show real, itemized costs and back them up with documentation. Choosing the documented-loss route without records to support it generally is not worthwhile, since the claim has to be substantiated.
The September 14 deadline
The single most important detail for anyone who thinks they qualify is the date. The claim deadline was extended to September 14, 2026. A claim filed after that point generally will not be honored, no matter how clearly a person was affected. Settlement windows like this one close for good, so the practical rule is to file well before the cutoff rather than risk a last-day glitch.
Filing is designed to be quick, especially for the flat payment, which does not require assembling paperwork. The documented-loss claim takes longer because it depends on gathering and submitting evidence, so anyone considering that path should start early enough to pull records together. Deadlines in class-action settlements are firm precisely because the fund has to be divided among everyone who files, and administrators generally cannot reopen the window for latecomers. A person who is even reasonably sure they were an Xfinity customer during the affected period is better served filing and letting the administrator confirm eligibility than talking themselves out of it and missing the date.
File free at the official administrator
Claims are handled at no cost through the court-appointed settlement administrator’s website, comcastbreachsettlement.com. The official settlement claims site is where eligible customers confirm their status, choose a payment option, and submit before the deadline. There is no charge to file, and no legitimate part of the process asks a claimant to pay to receive money.
That last point matters because high-profile settlements attract imposters. Scammers set up look-alike sites or send emails and texts posing as the administrator, hoping to collect fees or personal data from people rushing to claim. The defense is to use only the official address and to remember that filing is free. Any site or message demanding a payment to process a breach claim should be treated as fraudulent.
Why it is worth the few minutes
A flat $50 payment will not make anyone whole for the stress of a data breach, but it is real money returned to affected customers for a few minutes of effort, and the alternative is leaving it on the table. For households that were Xfinity customers in 2023, checking eligibility costs nothing and closes out a genuine claim rather than letting the window lapse.
The breach also serves as a reminder to shore up accounts that shared the exposed details, particularly any that relied on the same security questions or passwords. Independent coverage of the settlement, including who qualifies and how the two payment tiers work, is available through outlets such as CNBC’s rundown of the settlement, but the claim itself should always be filed through the official administrator by September 14, 2026.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
