Something went wrong in Comcast’s systems in October 2023. In a cybersecurity breach that affected millions of Xfinity customers, usernames, passwords, contact information, dates of birth, and partial Social Security numbers were made public. This is the kind of information that people give out without giving it much thot when they sign up for internet service. People were told about it in December 2023. They were probably skimmed by most people. The email was probably deleted by some people without being read. There was a chance that was wrong.
Now, Comcast has agreed to pay $117.5 million to end the lawsuit brought by a group of people. People can still file claims for the settlement, but the final court approval hasn’t happened yet. The deadline to do so is September 14. People don’t usually pay attention to this kind of case, but the numbers are hard to ignore, both for the customers who were affected and for anyone watching how a company this size handles a crisis it caused itself.
It was very clear in the lawsuit. It said that Comcast “failed to properly protect personal information” and had “poor data security.” As companies almost always do in these situations, Comcast has denied doing anything wrong. To agree to pay $117.5 million is, however, a statement in its own right. A company doesn’t settle like this because it feels morally obliged to. Trials aren’t always the best option because they come with costs and unknown outcomes.
The next step for customers who have been affected is pretty easy, if a bit bureaucratic. People in the settlement class who got a breach notice from Comcast in December 2023 are included. They can make a claim for up to $10,000 in documented out-of-pocket losses or time spent dealing with the breach. For those who don’t want to deal with all that paperwork, there is an easier option: a flat $50 payment. Both ways have the same due date of September 14. Both of those amounts are not set in stone; the final payout will depend on how many people file claims and how much settlement money is available.
Seeing this happen makes me feel a little angry. People whose information was stolen didn’t choose to give their Social Security numbers to a business that didn’t have good security. All they wanted was cable internet. They are now being asked to fill out forms, gather proof, and find their way around a settlement website in order to get some of the damage back. People who don’t have the bandwidth (no pun intended) to fight for more probably chose the $50 option.
The picture looks more complicated from the point of view of an investor. There has been a rough patch for Comcast’s stock. It is down about 25% in the last year and almost 50% over the last five years. The settlement adds to the stress on a balance sheet that was already under a lot of stress. Earnings are expected to go down over the next few years, and more spending on cybersecurity for compliance reasons could make it harder for things to get better. The stock does have a dividend yield of about 5.7%, which is good for long-term investors. However, it’s hard not to wonder if management has a clear plan for how to stop this kind of breach from happening again.
What’s going to happen next is likely the most important question. The number $117.5 million is big, but Comcast can handle it in the end. A pattern is harder to take in. If people start to link Xfinity with data breaches, if regulators pay more attention, and if the company is seen as slow to invest in the infrastructure that protects personal data, the damage to its reputation gets worse in ways that settlement payments can’t fully fix. It’s possible that the breach will be the turning point that makes things really better. It could also just be a footnote, forgotten until something similar happens again.
If you got a breach notice from Comcast in December, the best thing to do right now is file a claim before September 14. The process is real. There is cash available. Things won’t be right, but you can have it.
