Comcast Xfinity customer data theft via Citrix Bleed
Between October 16 and October 19, 2023, before Comcast had finished mitigating, attackers exploited Citrix Bleed (CVE-2023-4966) in its NetScaler systems; Citrix had announced the flaw and a patch on October 10 and issued further mitigation guidance on October 23. On November 16 Comcast determined data was likely taken: usernames and hashed passwords, and for some customers names, contact details, last four digits of Social Security numbers, dates of birth and secret questions. Xfinity disclosed on December 18, 2023 and forced password resets.
- Victim
- Comcast (Xfinity)
- Industry
- Telecom
- Country
- United States
- Intrusion began
- Oct 16, 2023
- First disclosed
- Dec 18, 2023
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- 35.9 million (Customers, per Comcast's filing with the Maine attorney general (TechCrunch reported it as almost 35.8 million).)
- Disclosed cost
- Not disclosed
The identity lesson
Citrix Bleed exposed session tokens, so the fix was patch plus terminating all existing sessions. Gaps of days between disclosure and patching, without session revocation, were enough for theft at scale.
Go deeper on SWI
- Technique: Token replay against an unbound endpoint
- Vulnerability: Citrix Bleed, session-token leak from NetScaler ADC
Sources
- Notice to customers of data security incident, Xfinity, Dec 18, 2023
- Comcast says hackers stole data of close to 36 million Xfinity customers, TechCrunch, Dec 19, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Boeing Distribution breached by LockBit via Citrix Bleed session hijacking 2023 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
- MITRE NERVE network breached via Ivanti zero-days and session hijacking 2024 · Identity infrastructure vulnerability
- Stolen Microsoft 365 session tokens replayed into 79 organizations 2026 · Phishing (adversary-in-the-middle)
Cite this record
SWI Community Team. (2026). Comcast Xfinity customer data theft via Citrix Bleed. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-comcast-xfinity-citrix-bleed/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.