Judge Approves $117.5 Million Settlement in 'Complex' Comcast Data Breach Case

A federal judge has approved a $117.5 million data breach settlement against Comcast Cable Communications, representing one of the largest data breach settlement amounts and, with 31.7 million potential members, one of the largest classes in a data breach case. The case arose from a breach that occurred between October 16 and October 19, 2023, when cybercriminals exploited the "Citrix Bleed" vulnerability in the Citrix NetScaler appliance used by Comcast to manage remote access. Comcast did not notify affected customers until December 18, 2023, roughly two months after the intrusion.

The plaintiffs claimed that Comcast failed to timely install a patch Citrix had made available, that Citrix failed to adequately test and monitor its NetScaler product, and that both companies' conduct exposed class members to identity theft, fraud, and further injury. The breach exposed personal information including names, contact information, dates of birth, the last four digits of Social Security numbers, secret questions and answers, and, for some members, full Social Security numbers and driver's license numbers. The plaintiffs asserted 23 causes of action, including state common law and statutory claims, as well as claims under the federal Cable Communications Policy Act—the first time this law had been invoked for a cable company data breach, according to class counsel. Comcast and Citrix denied all allegations of wrongdoing.

The settlement, reached through five mediation sessions, releases both Comcast and Citrix from all class claims, though the $117.5 million common fund is being funded solely by Comcast. Class members may submit claims up to $10,000 for out-of-pocket losses and lost time, or alternatively claim a $50 cash payment, and all members receive a free credit monitoring subscription. The court approved a $31.7 million attorneys' fee, or 27% of the settlement fund, noting that data breach litigation is "inherently complex" due to difficulties in proving class-wide damages and unresolved questions about the duty of care. The case spanned approximately two years from filing to global resolution.

(Source：Insurance Journal)