Comcast has said that hackers used a serious security flaw to get into the private details of nearly 36 million Xfinity customers. This flaw, called “CitrixBleed,” is in Citrix networking devices commonly used by large companies. Hackers have been taking advantage of this flaw since late August.
Although Citrix released fixes in early October, many companies didn’t update in time. The hackers used the CitrixBleed flaw to access information from major targets, like Boeing, the Industrial and Commercial Bank of China, and the international law firm Allen & Overy.
Xfinity Targeted, Unveiling the CitrixBleed Breach
Xfinity, which is Comcast’s cable TV and internet part, is the newest target of CitrixBleed, as confirmed by the company in a customer notice on Monday. The large U.S. telecom company revealed that hackers took advantage of the CitrixBleed issue to enter its internal systems from October 16 to October 19. However, the company only discovered this “malicious activity” on October 25.
By November 16, Xfinity found that the hackers probably got hold of information. In December, the company confirmed that this included customer data such as usernames and “hashed” passwords. Hashed passwords are encrypted and stored in a way that’s tough for humans to read. It’s not clear right away how the passwords were encrypted or which method was used, as some weaker encryption methods can be decoded.
The company states that for an unspecified number of customers, the hackers might have also reached names, contact details, birthdates, the last four digits of Social Security numbers, and their secret questions and answers.
Comcast’s Data Breach
Comcast mentions that they’re still analyzing data, and they will share more information if needed. This implies that other types of data might have been reached as well.
The notice doesn’t specify the number of affected Xfinity customers, and Joel Shadle, a spokesperson for Comcast, didn’t provide this information. In a report to Maine’s attorney general, Comcast confirmed that almost 35.8 million customers are impacted by the breach. According to Comcast’s latest earnings report, the company has over 32 million broadband customers, indicating that this breach likely affects most, if not all, Xfinity customers.
It is currently unclear if Xfinity was subjected to a ransom demand, how the event affected the company’s operations, or whether the incident has been reported to the U.S. Securities and Exchange Commission, as mandated by the regulator’s new rules on reporting data breaches. Comcast’s spokesperson did not provide this information.
Shadle stated, “We have no knowledge of any customer data being leaked or any attacks on our customers.”
Xfinity is instructing customers to reset their passwords and suggests the adoption of two-factor or multi-factor authentication for all customer accounts, even though the company doesn’t make it mandatory by default. Moreover, Recently, the personal genomics and biotechnology company 23andMe reported a security breach, revealing that data from 6.9 million users was leaked.
Conclusion
Comcast revealed a significant data breach affecting nearly 36 million Xfinity customers due to the CitrixBleed flaw. The breach impacted internal systems, compromising sensitive customer data. Despite ongoing analysis, the full extent remains unclear, raising concerns about potential ransom demands and operational impacts. Affected customers are urged to reset passwords and consider enhanced authentication. The incident underscores the broader challenges in securing digital infrastructure.
