HackingStolen CredentialsVulnerability ExploitSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedCREDENTIALSIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Xfinity
bd_5355437d076882a9 · schema v1 · pii pii-v1
Full breach record for Xfinity →Xfinity (Comcast Cable) disclosed a data security incident involving unauthorized access to internal systems via a Citrix software vulnerability between October 16-19, 2023. The breach exposed usernames, hashed passwords, and for some customers, names, contact info, last four SSN digits, and dates of birth. Xfinity patched systems, reset passwords, and notified law enforcement. This notice covers Delaware, New York, and North Carolina residents.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_5bfeb65433187961Delaware State AGfiled 2024-01-26(39d gap)Candidate
Source provenance
- Source URL
- https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2023/12/Comcast-Xfinity-Customer-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 18, 2023
- Raw hash
- f0e34cc9f75515643f0c47e94a40adcbf85de8db3e075c1fb9ee6674b5746a4f
Reporting entity
- Name
- Comcast Cable Holdings, LLCnorm: comcast cable
Victim entity
- Name
- Xfinitynorm: xfinity
Incident
- Discovered
- Oct 16, 2023
- Materiality determined
- Nov 16, 2023
- Notification sent
- Dec 6, 2023
- Affected individuals
- Not disclosed
- Data types
- CREDENTIALSIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- notified federal law enforcement
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 9 weeks(63 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.